Linux kernel BPF: LPM trie RCU annotations reject sleepable programs and spam lockdep warnings

Impact

The commit is explicit that there is no use-after-free here: Tasks Trace RCU already serializes against the trie's reclaim path, and the observable effect is a 'suspicious RCU usage' splat once per callsite on lockdep-enabled kernels. What is affected is any node running a sleepable BPF LSM program that touches an LPM trie, which on GPU clusters usually means Cilium or Tetragon-style policy tooling. NVD carries CVSS 7.8 with high confidentiality and integrity impact; nothing in the record supports that reading, and kernels built without RCU lockdep checking see no behaviour change at all. This is a correctness and annotation fix, not a reason to open a maintenance window tonight.

Who can reach it

Local, and only on lockdep-enabled kernels: any process that triggers a sleepable BPF LSM hook which does an LPM trie lookup, update or delete. Production kernels without CONFIG_PROVE_RCU show no observable effect, and no privilege boundary is crossed.

What to do

Pick the fix up with your next scheduled kernel update; five stable commits are linked. It changes rcu_dereference_check() and rcu_dereference_protected() annotations only, so no out-of-band maintenance is warranted on production kernels. If you run lockdep kernels in a test fleet and the splats are drowning the logs, apply the same commits there.

References

Related entries

• Linux BPF: BTF repeated-field count overflow allows an out-of-bounds write on BPF_BTF_LOADCVE-2026-64354 · Linux kernel BPF BTF parser (btf_repeat_fields expansion)High
• Linux mm: shrinker_info teardown races with expansion, giving a double free of memcg shrinker mapsCVE-2026-64418 · Linux kernel memcg shrinker_info (alloc/teardown race with expand_shrinker_info)High
• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel iomap: zero-length write range underflows into an out-of-bounds bitmap_set()CVE-2026-68145 · Linux kernel iomap (ifs_set_range_dirty / ifs_set_range_uptodate)High
• Linux kernel libceph: use-after-free reading the monmap debugfs file during client teardownCVE-2026-68153 · Linux kernel libceph (per-client debugfs files vs client teardown)High