Linux kernel BPF: preemptible bpf_get_stack reuses a per-CPU callchain buffer and writes out of bounds

Impact

get_perf_callchain() releases its recursion slot before returning, so nothing keeps the per-CPU perf_callchain_entry reserved while __bpf_get_stack() copies from it. A preemptible BPF program - a non-sleepable raw tracepoint program on a PREEMPT kernel runs under migrate_disable() but not preempt_disable() - can be scheduled out between obtaining the entry and the copy. Another task on the same CPU reuses the buffer and inflates trace->nr, so copy_len exceeds the caller's buffer and the memcpy writes out of bounds in both the plain and build_id paths. The rcu_read_lock() previously taken does not prevent this. GPU nodes run continuous profiling and eBPF observability agents that call bpf_get_stack on hot tracepoints, which is exactly the workload that hits this.

Who can reach it

Local, and requires the ability to load and attach a BPF program - CAP_BPF plus the relevant attach capability, or root. On most fleets that is the node's observability agent rather than a tenant, so the realistic risk is an unstable or compromised agent corrupting kernel memory, not direct tenant escalation.

What to do

Update to a stable kernel that disables preemption around obtaining and copying the callchain entry and defers build-id resolution until afterwards, then drain and reboot the node. As an interim step, restrict CAP_BPF to the observability agent and confirm no tenant workload can attach BPF programs. The record names four stable commits and no fixed release.

References

Related entries

• Linux kernel BPF x86 JIT: per-CPU address lands in the wrong register, clobbering RAX or the frame pointerCVE-2026-89581 · Linux kernel BPF x86-64 JIT (per-CPU address MOV register encoding)Unscored
• Linux kernel GHES: CXL CPER work locks taken without IRQ protection can deadlock a CPUCVE-2026-89589 · Linux kernel ACPI APEI GHES (CXL CPER work locks)Unscored
• Linux kernel hugetlb: reservation counter underflow when a parent unmaps a shared huge page firstCVE-2026-89593 · Linux kernel hugetlb (__unmap_hugepage_range reservation accounting)Unscored
• Linux kernel efivarfs: unprivileged statfs() floods the UEFI QueryVariableInfo runtime serviceCVE-2026-89604 · Linux kernel efivarfs (statfs handler, QueryVariableInfo rate limit)Unscored
• Linux CephFS client: unchecked dentry name length overflows a NAME_MAX buffer in the NFS re-export pathCVE-2026-89652 · Linux kernel CephFS client (ceph_get_name / __get_snap_name, NFS-export path)Unscored
• Linux CephFS client: out-of-range MDS rank in mdsmap export_targets writes past a stack bitmapCVE-2026-89653 · Linux kernel CephFS client (mdsmap decode, export_targets rank validation)Unscored