Linux BPF: bpf_timer_init allocation under rq_lock can hard-lock a host CPU

Impact

__bpf_async_init() allocated with GFP_ATOMIC, so a memcg charge raised during bpf_timer_init() could call cgroup_file_notify() and re-acquire a lock the caller already holds. The record shows a hardlockup from double-acquiring the same rq_lock when a sched_ext BPF program calls bpf_timer_init() from ops.runnable(), and notes other variants (cgroup_file_kn_lock, worker_pool::lock). A hardlockup is an unrecoverable host hang: every GPU job on the node dies and the node needs a reset, not a graceful drain. Reachable only where BPF programs - particularly sched_ext schedulers - run on the host, which is increasingly true of clusters tuning scheduling for accelerator workloads.

Who can reach it

Local and privileged: requires loading a BPF program (root or CAP_BPF, plus CAP_SYS_ADMIN-class rights for sched_ext) that calls bpf_timer_init() on a path holding rq_lock, together with memory pressure that triggers an MEMCG_MAX event. Not reachable by an ordinary tenant pod without BPF rights.

What to do

Take the stable kernel update that switches __bpf_async_init() to __GFP_HIGH so the memcg path runs with allow_spinning=false (five stable commits linked in the record; it depends on the companion mm patch, and no fixed release number is stated). Rolling it out means draining and rebooting nodes. Short of that, not running custom sched_ext/BPF programs that call bpf_timer_init() from locked scheduler callbacks avoids the path.

References

Related entries

• Linux kernel af_alg: concurrent writes to one socket corrupt internal state, local denial of serviceCVE-2025-39964 · Linux kernel crypto/af_alg (concurrent sendmsg on one AF_ALG socket)Medium
• Linux x86/mce: broken copy-from-user fixup turns a recoverable memory error into a host panicCVE-2025-39989 · Linux kernel x86 machine-check handler (hwpoison copy-from-user recovery)Medium
• Linux kernel (drivers/pci/endpoint/functions): The endpoint test function releases DMA channels it may never haveCVE-2025-40032 · Linux kernel (drivers/pci/endpoint/functions)Medium
• Linux kernel (drivers/pci/pcie): AER's rate limiter dereferences per-device error state without checking it exists.CVE-2025-40034 · Linux kernel (drivers/pci/pcie)Medium
• Linux kernel (drivers/iommu/iommufd): A user-supplied page shift of 63 overflows the divisor in the iommufdCVE-2025-40293 · Linux kernel (drivers/iommu/iommufd)Medium
• Linux kernel (drivers/pci/pcie): The AER subsystem allocates its per-device error-tracking structure without checkingCVE-2025-68309 · Linux kernel (drivers/pci/pcie)Medium