Database/Kernel, userspace & hypervisor
Linux kernel bpf: preemption left enabled in bpf_event_output corrupts shared perf sample buffer
Impact
bpf_event_output uses per-CPU nesting protection but ran with preemption enabled when called from cgroup BPF programs, so two tasks can end up sharing one perf_sample_data buffer. The reported result is a kernel NULL-pointer dereference and crash, hit in production by Cilium's cgroup socket programs. On a Kubernetes GPU node this is an unplanned host crash under ordinary CNI operation, killing every pod on the node including long-running training jobs with no checkpoint window.
Who can reach it
Local, triggered through cgroup-attached BPF programs (such as a CNI's connect/sockaddr hooks) - attaching them requires privilege, but once an eBPF dataplane is installed any pod's socket activity can drive the path. No authentication beyond running a workload on the node.
What to do
Update to a stable kernel containing the preempt-disable fix (commits 063c9ce8e74e, 3048cb0dc0cc, 36dd8ca330b7, c81bdf8f9f2b, d62cc390c2e9) and reboot each node. No runtime mitigation other than removing the cgroup BPF programs that call bpf_event_output, which generally means disabling the CNI feature that installs them.
References
Related entries
- Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2023-54202 · Linux i915 GPU kernel driverHigh
- Linux kernel (netfilter pipapo): Inactive elements mishandled in nft_pipapo_walk - use-after-free, local rootCVE-2023-6817 · Linux kernel (netfilter pipapo)High
- Linux kernel (io_uring): Page use-after-free via io_uring buffer-ring mmap - unprivileged local user to rootCVE-2024-0582 · Linux kernel (io_uring)High
- Linux kernel (nf_tables): Use-after-free in nft_verdict_init() - double-free to local rootCVE-2024-1086 · Linux kernel (nf_tables)High
- Linux kernel (ksmbd): Use-after-free in ksmbd_tcp_new_connection() - in-kernel SMB serverCVE-2024-26592 · Linux kernel (ksmbd)High
- Linux kernel (drivers/iommu/iommufd): On a partially-failed access attach, iommufd overwrites the xarray id that tracksCVE-2024-26786 · Linux kernel (drivers/iommu/iommufd)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.