CVE-2026-89580 (GCVE-0-2026-89580)
Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-10-30 12:32
VLAI
EPSS
VEX
Title
bpf: Disable preemption in __bpf_get_stack
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disable preemption in __bpf_get_stack
get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and
releases its recursion slot via put_callchain_entry() before returning,
so nothing keeps the entry reserved while __bpf_get_stack() consumes
it below.
A preemptible BPF program (e.g. a non-sleepable raw tracepoint program
on a PREEMPT kernel, which runs under migrate_disable() but not
preempt_disable()) can be scheduled out between obtaining the entry
and the copy. Another task scheduled on the same CPU then reuses the
same per-CPU buffer and overwrites trace->nr with a larger value.
copy_len is then computed from the inflated trace->nr and can exceed
the caller's buffer, causing an out-of-bounds write in the memcpy()
and in the build_id path.
The rcu_read_lock() taken here alone does not prevent this. It is
only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does
not disable preemption; it merely keeps perf's callchain buffer array
alive (freed via call_rcu()) and does nothing to stop another task
from reusing the entry.
Disable preemption around obtaining the callchain entry and copying
it into the caller's buffer, so the entry cannot be reused underneath
us and trace->nr stays bounded by max_depth. Build ID resolution may
fault and is therefore deferred until after preemption is re-enabled;
by then the instruction pointers have already been copied into buf,
so it operates only on that private copy. Note, preempt_disable() also
subsumes the buffer-lifetime guarantee the rcu_read_lock() provided,
since a preempt-disabled section is an RCU read-side critical section
for the callchain buffers' call_rcu() reclaim.
[ changed Fixes: commit ]
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:24 UTC
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
c195651e565ae7f41a68acb7d4aa7390ad215de1 , < 68eebc89c5ab5a8f9281773f35e49c83940450a0
(git)
Affected: c195651e565ae7f41a68acb7d4aa7390ad215de1 , < 719e69421de28829c72bf8a2722ab48a1c5a59ad (git) Affected: c195651e565ae7f41a68acb7d4aa7390ad215de1 , < 8c5ba022f2085ea42d011497a6e92e527d123b9b (git) Affected: c195651e565ae7f41a68acb7d4aa7390ad215de1 , < dbfecc8a6631c0d3626c14ba1f1a485a4498445a (git) Affected: c195651e565ae7f41a68acb7d4aa7390ad215de1 , < 9a23747909fcae707990c8466c381a0e7acfaa4e (git) Affected: c195651e565ae7f41a68acb7d4aa7390ad215de1 , < b1a47b2708d4e95dbd23aee2ec83752190897b3f (git) |
guessed | |
| Linux | Linux |
Affected:
4.18
Unaffected: 0 , < 4.18 (semver) Unaffected: 6.1.191 , ≤ 6.1.* (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89580",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:24:29.219775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:44.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/stackmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68eebc89c5ab5a8f9281773f35e49c83940450a0",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "719e69421de28829c72bf8a2722ab48a1c5a59ad",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "8c5ba022f2085ea42d011497a6e92e527d123b9b",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "dbfecc8a6631c0d3626c14ba1f1a485a4498445a",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "9a23747909fcae707990c8466c381a0e7acfaa4e",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "b1a47b2708d4e95dbd23aee2ec83752190897b3f",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/stackmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in __bpf_get_stack\n\nget_perf_callchain() returns a per-CPU perf_callchain_entry buffer and\nreleases its recursion slot via put_callchain_entry() before returning,\nso nothing keeps the entry reserved while __bpf_get_stack() consumes\nit below.\n\nA preemptible BPF program (e.g. a non-sleepable raw tracepoint program\non a PREEMPT kernel, which runs under migrate_disable() but not\npreempt_disable()) can be scheduled out between obtaining the entry\nand the copy. Another task scheduled on the same CPU then reuses the\nsame per-CPU buffer and overwrites trace-\u003enr with a larger value.\ncopy_len is then computed from the inflated trace-\u003enr and can exceed\nthe caller\u0027s buffer, causing an out-of-bounds write in the memcpy()\nand in the build_id path.\n\nThe rcu_read_lock() taken here alone does not prevent this. It is\nonly taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does\nnot disable preemption; it merely keeps perf\u0027s callchain buffer array\nalive (freed via call_rcu()) and does nothing to stop another task\nfrom reusing the entry.\n\nDisable preemption around obtaining the callchain entry and copying\nit into the caller\u0027s buffer, so the entry cannot be reused underneath\nus and trace-\u003enr stays bounded by max_depth. Build ID resolution may\nfault and is therefore deferred until after preemption is re-enabled;\nby then the instruction pointers have already been copied into buf,\nso it operates only on that private copy. Note, preempt_disable() also\nsubsumes the buffer-lifetime guarantee the rcu_read_lock() provided,\nsince a preempt-disabled section is an RCU read-side critical section\nfor the callchain buffers\u0027 call_rcu() reclaim.\n\n\n[ changed Fixes: commit ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in __bpf_get_stack(), reached only from bpf_get_stack/bpf_get_task_stack helpers in locally loaded tracing BPF (kprobe, tracepoint, raw_tp, perf_event, tracing) via bpf(2); kernel CNA guidance classifies BPF as Local, not a network path.\nAC:L - The attacker controls both sides of the race: a preemptible tracing program with a small bpf_get_stack buffer and a same-CPU helper/perf callchain with larger max_depth that reuses the per-CPU entry after put_callchain_entry(); pinning and retries make the window reliably hittable on PREEMPT kernels (e.g. Android).\nPR:L - Loading and attaching the required tracing programs needs CAP_BPF and CAP_PERFMON at bpf_prog_load(); per kernel CNA guidance these are Low because BPF tokens and user namespaces can delegate them to non-init-namespace users, not only real root.\nUI:N - The attacker loads their own BPF program, attaches it, and invokes the helper through their own syscalls or pinned threads; no victim mount, file open, or other user action is required.\nS:U - The out-of-bounds write corrupts kernel stack or slab inside the same host kernel security authority, enabling local privilege escalation; it does not cross a VM, IOMMU, or other distinct trust boundary.\nC:H - Inflated trace-\u003enr drives memcpy/build-id copies of kernel instruction pointers past the caller buffer (BPF stack or map value), which is kernel memory corruption that can be turned into an arbitrary read primitive.\nI:H - copy_len is taken from the reused per-CPU trace-\u003enr with no remaining size cap, so the memcpy or bpf_stack_build_id loop is an attacker-sized kernel OOB write (up to PERF_MAX_STACK_DEPTH frames) that can smash stack/heap and hijack control flow.\nA:H - The same unbounded kernel write past a small helper buffer causes a kernel oops or panic even when not fully weaponized, matching CNA guidance that any kernel crash or memory-corrupting OOB write is Availability High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:32:16.360Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68eebc89c5ab5a8f9281773f35e49c83940450a0"
},
{
"url": "https://git.kernel.org/stable/c/719e69421de28829c72bf8a2722ab48a1c5a59ad"
},
{
"url": "https://git.kernel.org/stable/c/8c5ba022f2085ea42d011497a6e92e527d123b9b"
},
{
"url": "https://git.kernel.org/stable/c/dbfecc8a6631c0d3626c14ba1f1a485a4498445a"
},
{
"url": "https://git.kernel.org/stable/c/9a23747909fcae707990c8466c381a0e7acfaa4e"
},
{
"url": "https://git.kernel.org/stable/c/b1a47b2708d4e95dbd23aee2ec83752190897b3f"
}
],
"title": "bpf: Disable preemption in __bpf_get_stack",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89580",
"datePublished": "2026-09-11T19:44:46.846Z",
"dateReserved": "2026-09-11T19:38:34.728Z",
"dateUpdated": "2026-10-30T12:32:16.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-89580",
"date": "2026-11-09",
"epss": "0.0013",
"percentile": "0.0262"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/stackmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68eebc89c5ab5a8f9281773f35e49c83940450a0",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "719e69421de28829c72bf8a2722ab48a1c5a59ad",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "8c5ba022f2085ea42d011497a6e92e527d123b9b",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "dbfecc8a6631c0d3626c14ba1f1a485a4498445a",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "9a23747909fcae707990c8466c381a0e7acfaa4e",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "b1a47b2708d4e95dbd23aee2ec83752190897b3f",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/stackmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in __bpf_get_stack\n\nget_perf_callchain() returns a per-CPU perf_callchain_entry buffer and\nreleases its recursion slot via put_callchain_entry() before returning,\nso nothing keeps the entry reserved while __bpf_get_stack() consumes\nit below.\n\nA preemptible BPF program (e.g. a non-sleepable raw tracepoint program\non a PREEMPT kernel, which runs under migrate_disable() but not\npreempt_disable()) can be scheduled out between obtaining the entry\nand the copy. Another task scheduled on the same CPU then reuses the\nsame per-CPU buffer and overwrites trace-\u003enr with a larger value.\ncopy_len is then computed from the inflated trace-\u003enr and can exceed\nthe caller\u0027s buffer, causing an out-of-bounds write in the memcpy()\nand in the build_id path.\n\nThe rcu_read_lock() taken here alone does not prevent this. It is\nonly taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does\nnot disable preemption; it merely keeps perf\u0027s callchain buffer array\nalive (freed via call_rcu()) and does nothing to stop another task\nfrom reusing the entry.\n\nDisable preemption around obtaining the callchain entry and copying\nit into the caller\u0027s buffer, so the entry cannot be reused underneath\nus and trace-\u003enr stays bounded by max_depth. Build ID resolution may\nfault and is therefore deferred until after preemption is re-enabled;\nby then the instruction pointers have already been copied into buf,\nso it operates only on that private copy. Note, preempt_disable() also\nsubsumes the buffer-lifetime guarantee the rcu_read_lock() provided,\nsince a preempt-disabled section is an RCU read-side critical section\nfor the callchain buffers\u0027 call_rcu() reclaim.\n\n\n[ changed Fixes: commit ]"
}
],
"id": "CVE-2026-89580",
"lastModified": "2026-10-30T13:20:22.230",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-89580",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:24:29.219775Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-11T20:19:42.270",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/68eebc89c5ab5a8f9281773f35e49c83940450a0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/719e69421de28829c72bf8a2722ab48a1c5a59ad"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/8c5ba022f2085ea42d011497a6e92e527d123b9b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9a23747909fcae707990c8466c381a0e7acfaa4e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b1a47b2708d4e95dbd23aee2ec83752190897b3f"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/dbfecc8a6631c0d3626c14ba1f1a485a4498445a"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T01:18:28+00:00",
"cve": "CVE-2026-89580",
"id": "CVE-2026-89580",
"initial_release_date": "2026-09-11T00:00:00+00:00",
"product_status:known_affected": "189",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: bpf: Disable preemption in __bpf_get_stack",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89580.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89580",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:24:29.219775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:24:29.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/stackmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "719e69421de28829c72bf8a2722ab48a1c5a59ad",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "8c5ba022f2085ea42d011497a6e92e527d123b9b",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "dbfecc8a6631c0d3626c14ba1f1a485a4498445a",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "9a23747909fcae707990c8466c381a0e7acfaa4e",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
},
{
"lessThan": "b1a47b2708d4e95dbd23aee2ec83752190897b3f",
"status": "affected",
"version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/stackmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in __bpf_get_stack\n\nget_perf_callchain() returns a per-CPU perf_callchain_entry buffer and\nreleases its recursion slot via put_callchain_entry() before returning,\nso nothing keeps the entry reserved while __bpf_get_stack() consumes\nit below.\n\nA preemptible BPF program (e.g. a non-sleepable raw tracepoint program\non a PREEMPT kernel, which runs under migrate_disable() but not\npreempt_disable()) can be scheduled out between obtaining the entry\nand the copy. Another task scheduled on the same CPU then reuses the\nsame per-CPU buffer and overwrites trace-\u003enr with a larger value.\ncopy_len is then computed from the inflated trace-\u003enr and can exceed\nthe caller\u0027s buffer, causing an out-of-bounds write in the memcpy()\nand in the build_id path.\n\nThe rcu_read_lock() taken here alone does not prevent this. It is\nonly taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does\nnot disable preemption; it merely keeps perf\u0027s callchain buffer array\nalive (freed via call_rcu()) and does nothing to stop another task\nfrom reusing the entry.\n\nDisable preemption around obtaining the callchain entry and copying\nit into the caller\u0027s buffer, so the entry cannot be reused underneath\nus and trace-\u003enr stays bounded by max_depth. Build ID resolution may\nfault and is therefore deferred until after preemption is re-enabled;\nby then the instruction pointers have already been copied into buf,\nso it operates only on that private copy. Note, preempt_disable() also\nsubsumes the buffer-lifetime guarantee the rcu_read_lock() provided,\nsince a preempt-disabled section is an RCU read-side critical section\nfor the callchain buffers\u0027 call_rcu() reclaim.\n\n\n[ changed Fixes: commit ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in __bpf_get_stack(), reached only from bpf_get_stack/bpf_get_task_stack helpers in locally loaded tracing BPF (kprobe, tracepoint, raw_tp, perf_event, tracing) via bpf(2); kernel CNA guidance classifies BPF as Local, not a network path.\nAC:L - The attacker controls both sides of the race: a preemptible tracing program with a small bpf_get_stack buffer and a same-CPU helper/perf callchain with larger max_depth that reuses the per-CPU entry after put_callchain_entry(); pinning and retries make the window reliably hittable on PREEMPT kernels (e.g. Android).\nPR:L - Loading and attaching the required tracing programs needs CAP_BPF and CAP_PERFMON at bpf_prog_load(); per kernel CNA guidance these are Low because BPF tokens and user namespaces can delegate them to non-init-namespace users, not only real root.\nUI:N - The attacker loads their own BPF program, attaches it, and invokes the helper through their own syscalls or pinned threads; no victim mount, file open, or other user action is required.\nS:U - The out-of-bounds write corrupts kernel stack or slab inside the same host kernel security authority, enabling local privilege escalation; it does not cross a VM, IOMMU, or other distinct trust boundary.\nC:H - Inflated trace-\u003enr drives memcpy/build-id copies of kernel instruction pointers past the caller buffer (BPF stack or map value), which is kernel memory corruption that can be turned into an arbitrary read primitive.\nI:H - copy_len is taken from the reused per-CPU trace-\u003enr with no remaining size cap, so the memcpy or bpf_stack_build_id loop is an attacker-sized kernel OOB write (up to PERF_MAX_STACK_DEPTH frames) that can smash stack/heap and hijack control flow.\nA:H - The same unbounded kernel write past a small helper buffer causes a kernel oops or panic even when not fully weaponized, matching CNA guidance that any kernel crash or memory-corrupting OOB write is Availability High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:57.787Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/719e69421de28829c72bf8a2722ab48a1c5a59ad"
},
{
"url": "https://git.kernel.org/stable/c/8c5ba022f2085ea42d011497a6e92e527d123b9b"
},
{
"url": "https://git.kernel.org/stable/c/dbfecc8a6631c0d3626c14ba1f1a485a4498445a"
},
{
"url": "https://git.kernel.org/stable/c/9a23747909fcae707990c8466c381a0e7acfaa4e"
},
{
"url": "https://git.kernel.org/stable/c/b1a47b2708d4e95dbd23aee2ec83752190897b3f"
}
],
"title": "bpf: Disable preemption in __bpf_get_stack",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89580",
"datePublished": "2026-09-11T19:44:46.846Z",
"dateReserved": "2026-09-11T19:38:34.728Z",
"dateUpdated": "2026-10-21T12:47:57.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.