Cloudanix VulnDB

CVE-2026-93173

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A mistake in how the Linux kernel cleans up certain security programs can make the computer crash without warning.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

The kernel invokes bpf_prog_free (a sleeping operation) from __bpf_prog_put_rcu inside softirq context when a sleepable LSM program is attached to a hook; this violates atomic context rules and triggers BUG: sleeping function called from invalid context.

Why it matters to the business

Systems may experience unexpected kernel crashes or panics during normal operation of BPF-based security programs, resulting in unplanned downtime and potential loss of availability for services relying on the affected kernel.

How an attack unfolds

An attacker loads a sleepable LSM BPF program onto a hook that participates in sleepable_lsm_hooks, then triggers program detachment or replacement; the subsequent RCU grace-period callback executes bpf_prog_free in softirq, causing the invalid-context BUG and system crash.

How to fix it

Upgrade to a kernel containing the fix that removes bpf_prog_free from sleepable_lsm_hooks; apply the latest stable kernel release that resolves the call_rcu context mismatch.

How to confirm the fix worked

Confirm the running kernel version includes the commit that drops bpf_prog_free from sleepable_lsm_hooks; reproduce the original call trace under load with sleepable LSM programs attached and verify absence of the BUG.

Typical attack path

  1. Load a sleepable LSM BPF program on an affected hook
  2. Trigger program put or replacement path
  3. RCU callback fires in softirq context
  4. security_bpf_prog_free calls bpf_prog_free causing BUG

How to detect it

Search kernel logs and dmesg for the exact BUG string 'sleeping function called from invalid context' together with the call trace containing __bpf_prog_enter_sleepable and security_bpf_prog_free; correlate with recent BPF program load or detach events.

  • BUG: sleeping function called from invalid context
  • __bpf_prog_enter_sleepable
  • security_bpf_prog_free
  • __bpf_prog_put_rcu

What your security team should do

  • Prioritize kernel upgrades on systems using sleepable LSM BPF programs
  • Monitor kernel logs for sleeping-function BUG messages in softirq context
  • Temporarily avoid attaching sleepable LSM programs to affected hooks until patched

The record

In the Linux kernel, the following vulnerability has been resolved: bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks __bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs. security_bpf_prog_free() called from there fires bpf_prog_free in softirq; if a sleepable LSM prog is attached to that hook, might_fault() BUGs: BUG: sleeping function called from invalid context in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038 preempt_count: 101, expected: 0 Call Trace: <IRQ> __bpf_prog_enter_sleepable+0x1cd/0x320 kernel/bpf/trampoline.c:1255 bpf_trampoline_6442549705+0x53/0xd7 security_bpf_prog_free+0xde/0x130 security/security.c:5465 __bpf_prog_put_rcu+0xab/0xd0 kernel/bpf/syscall.c:2365 rcu_do_batch kernel/rcu/tree.c:2617 [inline] handle_softirqs+0x236/0x800 kernel/softirq.c:622 </IRQ> The call_rcu/call_rcu_tasks_trace split reflects the freed program's sleepability, not that of any attached observer. security_bpf_prog_free() also frees prog->aux->security, which has to stay after the grace period, so drop bpf_prog_free from sleepable_lsm_hooks rather than move the call. Non-sleepable observers still run there.

Affected packages

Ecosystem Package Introduced Fixed