Linux kernel BPF: two timer callbacks cancelling each other deadlock the CPUs they run on

Impact

bpf_timer_cancel() waits synchronously for the target timer's callback to finish. Two BPF timer callbacks that cancel each other therefore each wait on the other, and both CPUs spin until the machine is wedged. The fix tracks in-flight cancellations in an atomic counter and returns -EDEADLK instead of busy-waiting. Reaching it requires the ability to load a BPF program with timers, which on a normal node means root or CAP_BPF - so this is an availability bug for hosts that let semi-trusted code load BPF (CNI/observability agents, operators handed CAP_BPF) rather than something a plain tenant pod can trigger. The consequence is a hung node that only a reboot clears, which on a GPU node means losing whatever training job was resident.

Who can reach it

Local, requires privilege to load BPF programs (root or CAP_BPF) and to run two timer callbacks that cancel one another. Not reachable from an unprivileged container without BPF access, and not remote.

What to do

Take the stable kernel update adding the cancelling counter (four stable branches carry it; the record gives commits, not release numbers). Rollout is a kernel install and a reboot per node. Until then, the practical mitigation is not granting CAP_BPF or root to workloads you do not trust to load correct BPF programs.

References

Related entries

• Linux drm/xe GPU kernel driver (display opregion): A resource leak in the xe driver's display opregion handlingCVE-2024-44980 · Linux drm/xe GPU kernel driver (display opregion)Medium
• Linux kernel (drivers/pci/hotplug): The hotplug driver disables MSI/MSI-X during slot unregistration after the MSI dataCVE-2024-46761 · Linux kernel (drivers/pci/hotplug)Medium
• Linux kernel ice: unserialized XDP setup races a PF reset and NULL-derefs on the TX ringCVE-2024-46765 · Linux kernel ice driver (XDP reconfiguration vs PF reset)Medium
• Linux kernel (drivers/gpu/drm/xe): Same per-client accounting path, different failure - if the fdinfo read drops theCVE-2024-46867 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel BPF verifier: sign-extended packet-pointer loads produce an invalid skb->data addressCVE-2024-47702 · Linux kernel BPF verifier (sign-extended loads of __sk_buff data/data_end/data_meta)Medium
• Linux kernel (drivers/gpu/drm/xe): User VM_BIND work is scheduled onto engines that can themselves take page faultsCVE-2024-47729 · Linux kernel (drivers/gpu/drm/xe)Medium