VulnerabilityPublished 25 Sep 2026Updated 21 Oct 2026

CVE-2026-98058: Linux kernel · bpf: Mark syscall helpers as sleepable

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in d05524794240b52fdc3b6c1220dd05505715824d : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in d05524794240b52fdc3b6c1220dd05505715824d, d8cfe9f71d302970ae393616960f2b3021d2b3b0, 9496d857205e60241034b798d7745ff8830ba599 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 79a7f8bdb159d9914b58740f3d31d602a6e4aca8, < d05524794240b52fdc3b6c1220dd05505715824d	Fixed in d05524794240b52fdc3b6c1220dd05505715824d
LinuxLinux	Affected ≥ 79a7f8bdb159d9914b58740f3d31d602a6e4aca8, < d8cfe9f71d302970ae393616960f2b3021d2b3b0	Fixed in d8cfe9f71d302970ae393616960f2b3021d2b3b0
LinuxLinux	Affected ≥ 79a7f8bdb159d9914b58740f3d31d602a6e4aca8, < 9496d857205e60241034b798d7745ff8830ba599	Fixed in 9496d857205e60241034b798d7745ff8830ba599
LinuxLinux	Affected ≥ 79a7f8bdb159d9914b58740f3d31d602a6e4aca8, < 3408e98f06ce06ea6a58ca6c39da9c23f0029c06	Fixed in 3408e98f06ce06ea6a58ca6c39da9c23f0029c06
LinuxLinux	Affected ≥ 79a7f8bdb159d9914b58740f3d31d602a6e4aca8, < 65f636322ac402add6046c68e9ece77b9ffd71c9	Fixed in 65f636322ac402add6046c68e9ece77b9ffd71c9
LinuxLinux	Affected =5.14	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFP_KERNEL, and wait for an RCU grace period. bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as well. Both helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is sleepable. That does not make every callback sleepable: a syscall program can register a bpf_timer callback, and the verifier checks that callback in a non-sleepable context while retaining the syscall helper set. Without .might_sleep on the prototypes, such a callback can invoke bpf_sys_bpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. bpf_sys_close() is exposed through the same missing context check. Set .might_sleep on both prototypes so the existing helper-context check rejects them from timer callbacks and other atomic regions. Calls from the sleepable main body remain valid.

References

Community reviews

Loading reviews…