GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-93138

Vulnerability from fkie_nvd - Published: 2026-09-17 17:18 - Updated: 2026-09-17 17:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux bpf_get_btf_vmlinux() lazily parses the vmlinux BTF under the bpf_verifier_lock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing orders the stores initializing the struct btf inside btf_parse_vmlinux() against the store publishing the pointer: On a weakly ordered arch, a concurrent first-time caller taking the lockless fast path could in principle observe the pointer before the parsed contents are visible. The mutex_unlock() does not help such a reader given it only synchronizes with a later acquisition of the same lock. Thus, publish the pointer with smp_store_release() and read it on the fast path with smp_load_acquire(). Acquire semantics are needed rather than a dependency-ordered READ_ONCE(): btf_parse_vmlinux() also populates globals outside the returned object (e.g. bpf_ctx_convert.t). An address dependency would only order accesses performed through the pointer and not cover other globals.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2892f3f44bf865c8fb6b6c0960edec4cc91806ee
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/86d11c594d60b255b526fa5260f669463fb1a063
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/92863e678070f57c17c868e4bfa2441a5c61ad2b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/978524ecfc1c539282df5858de1eec20748c6f74
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a7fe72d780122eb934536f1719abad445f6afdf7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e18a10b39c994f04e1ebd7f8fc042bb1ca8ad053
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/eaf302628a78806f66d8224d6ba03fb4d5025de4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f32a4a40bc635be25d6816da4bd91e9e58c31bf3
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f32a4a40bc635be25d6816da4bd91e9e58c31bf3",
              "status": "affected",
              "version": "8580ac9404f6240668a026785d7d8856f0530409",
              "versionType": "git"
            },
            {
              "lessThan": "a7fe72d780122eb934536f1719abad445f6afdf7",
              "status": "affected",
              "version": "8580ac9404f6240668a026785d7d8856f0530409",
              "versionType": "git"
            },
            {
              "lessThan": "e18a10b39c994f04e1ebd7f8fc042bb1ca8ad053",
              "status": "affected",
              "version": "8580ac9404f6240668a026785d7d8856f0530409",
              "versionType": "git"
            },
            {
              "lessThan": "978524ecfc1c539282df5858de1eec20748c6f74",
              "status": "affected",
              "version": "8580ac9404f6240668a026785d7d8856f0530409",
              "versionType": "git"
            },
            {
              "lessThan": "eaf302628a78806f66d8224d6ba03fb4d5025de4",
              "status": "affected",
              "version": "8580ac9404f6240668a026785d7d8856f0530409",
              "versionType": "git"
            },
            {
              "lessThan": "2892f3f44bf865c8fb6b6c0960edec4cc91806ee",
              "status": "affected",
              "version": "8580ac9404f6240668a026785d7d8856f0530409",
              "versionType": "git"
            },
            {
              "lessThan": "86d11c594d60b255b526fa5260f669463fb1a063",
              "status": "affected",
              "version": "8580ac9404f6240668a026785d7d8856f0530409",
              "versionType": "git"
            },
            {
              "lessThan": "92863e678070f57c17c868e4bfa2441a5c61ad2b",
              "status": "affected",
              "version": "8580ac9404f6240668a026785d7d8856f0530409",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux\n\nbpf_get_btf_vmlinux() lazily parses the vmlinux BTF under the\nbpf_verifier_lock, but publishes the result through a plain store\nand re-checks it through a plain lockless load. Nothing orders\nthe stores initializing the struct btf inside btf_parse_vmlinux()\nagainst the store publishing the pointer: On a weakly ordered\narch, a concurrent first-time caller taking the lockless fast\npath could in principle observe the pointer before the parsed\ncontents are visible. The mutex_unlock() does not help such a\nreader given it only synchronizes with a later acquisition of the\nsame lock. Thus, publish the pointer with smp_store_release()\nand read it on the fast path with smp_load_acquire().\n\nAcquire semantics are needed rather than a dependency-ordered\nREAD_ONCE(): btf_parse_vmlinux() also populates globals outside\nthe returned object (e.g. bpf_ctx_convert.t). An address\ndependency would only order accesses performed through the\npointer and not cover other globals."
    }
  ],
  "id": "CVE-2026-93138",
  "lastModified": "2026-09-17T17:18:08.720",
  "metrics": {},
  "published": "2026-09-17T17:18:08.720",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2892f3f44bf865c8fb6b6c0960edec4cc91806ee"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/86d11c594d60b255b526fa5260f669463fb1a063"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/92863e678070f57c17c868e4bfa2441a5c61ad2b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/978524ecfc1c539282df5858de1eec20748c6f74"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a7fe72d780122eb934536f1719abad445f6afdf7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e18a10b39c994f04e1ebd7f8fc042bb1ca8ad053"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/eaf302628a78806f66d8224d6ba03fb4d5025de4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f32a4a40bc635be25d6816da4bd91e9e58c31bf3"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.