Linux kernel bpf/cgroup: BUG() in purge_effective_progs on detach after allocation failure

Impact

Detaching a cgroup-attached BPF program can hit a BUG() in purge_effective_progs when a prior kmalloc fails and the code falls back to the purge path: the loop position counter skips the remaining layers and the cgroup pointer ends up NULL. The result is a kernel panic, taking the whole node down. On a GPU host that means every job on the box dies and the node needs a reboot to come back. Reaching it needs a nested cgroup hierarchy with programs attached at two levels plus a memory allocation failure - the syzkaller reproducer uses fault injection, so hitting it by accident requires the machine to already be under allocation pressure. No memory corruption or privilege escalation is claimed, only the panic.

Who can reach it

Local user able to attach and detach cgroup BPF programs, which normally means CAP_BPF/CAP_SYS_ADMIN in the init namespace or a privileged container. Not reachable by an unprivileged tenant pod under a default policy, and not reachable remotely.

What to do

Apply the stable kernel fix through your distribution's kernel update (four backport commits are listed) and reboot the affected hosts. Because exploitation needs privileged BPF access, this can usually wait for the next scheduled node-drain window rather than an emergency reboot; container runtimes and observability agents that attach cgroup BPF programs are the practical exposure to review.

References

Related entries

• Linux kernel cpuset: attaching a task to a cgroup v2 cpuset with an empty cpus_allowed panics the hostCVE-2022-50103 · Linux kernel cpuset/deadline scheduler (task_can_attach, dl_cpu_busy)High
• Linux kernel (drivers/vfio/pci/hisilicon): The VFIO migration save and resume paths do not advance the data pointer byCVE-2023-52453 · Linux kernel (drivers/vfio/pci/hisilicon)High
• Linux kernel BPF verifier: missing Spectre v4 sanitization leaks kernel pointers to unprivileged BPFCVE-2023-53024 · Linux kernel BPF verifier (speculative store bypass sanitization of stack slots)High
• Linux kernel scsi/ses: out-of-bounds desc_ptr accesses while parsing enclosure dataCVE-2023-53675 · Linux kernel scsi: ses (enclosure descriptor parsing)High
• Linux kernel arm64: negative length in IP checksum code causes out-of-bounds readCVE-2023-53726 · Linux kernel arm64 csum (do_csum negative length handling)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A tenant that asks for a fence event on its DRM fd and then reads the fd backCVE-2024-36960 · Linux kernel (drivers/gpu/drm/vmwgfx)High