CVE-2026-93138bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux bpf_get_btf_vmlinux() lazily parses the vmlinux BTF under the bpf_verifier_lock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing orders the stores initializing the struct btf inside btf_parse_vmlinux() against the store publishing the pointer: On a weakly ordered arch, a concurrent first-time caller taking the lockless fast path could in principle observe the pointer before the parsed contents are visible. The mutex_unlock() does not help such a reader given it only synchronizes with a later acquisition of the same lock. Thus, publish the pointer with smp_store_release() and read it on the fast path with smp_load_acquire(). Acquire semantics are needed rather than a dependency-ordered READ_ONCE(): btf_parse_vmlinux() also populates globals outside the returned object (e.g. bpf_ctx_convert.t). An address dependency would only order accesses performed through the pointer and not cover other globals.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8580ac9404f6240668a026785d7d8856f0530409 before f32a4a40bc635be25d6816da4bd91e9e58c31bf3; from 8580ac9404f6240668a026785d7d8856f0530409 before a7fe72d780122eb934536f1719abad445f6afdf7; from 8580ac9404f6240668a026785d7d8856f0530409 before e18a10b39c994f04e1ebd7f8fc042bb1ca8ad053; from 8580ac9404f6240668a026785d7d8856f0530409 before 978524ecfc1c539282df5858de1eec20748c6f74; from 8580ac9404f6240668a026785d7d8856f0530409 before eaf302628a78806f66d8224d6ba03fb4d5025de4; 8580ac9404f6240668a026785d7d8856f0530409 builds before 2892f3f44bf865c8fb6b6c0960edec4cc91806ee; 8580ac9404f6240668a026785d7d8856f0530409 builds before 86d11c594d60b255b526fa5260f669463fb1a063; from 8580ac9404f6240668a026785d7d8856f0530409 before 92863e678070f57c17c868e4bfa2441a5c61ad2b | CNA record |
References
- https://git.kernel.org/stable/c/f32a4a40bc635be25d6816da4bd91e9e58c31bf3
- https://git.kernel.org/stable/c/a7fe72d780122eb934536f1719abad445f6afdf7
- https://git.kernel.org/stable/c/e18a10b39c994f04e1ebd7f8fc042bb1ca8ad053
- https://git.kernel.org/stable/c/978524ecfc1c539282df5858de1eec20748c6f74
- https://git.kernel.org/stable/c/eaf302628a78806f66d8224d6ba03fb4d5025de4
- https://git.kernel.org/stable/c/2892f3f44bf865c8fb6b6c0960edec4cc91806ee
- https://git.kernel.org/stable/c/86d11c594d60b255b526fa5260f669463fb1a063
- https://git.kernel.org/stable/c/92863e678070f57c17c868e4bfa2441a5c61ad2b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.