The Linux kernel's BPF subsystem had a vulnerability where deleting local storage during NMI could cause deadlocks due to deferred freeing mechanisms like kfree_rcu(), call_rcu(), or call_rcu_tasks_trace(). Since deleting local storage in NMI is rare, the current partial mitigation returns an error when deletion is attempted in NMI via bpf_xxx_storage_delete() helpers. However, deadlocks remain possible in reentrant contexts. A complete fix would require nolock versions of call_rcu or deferring free operations through irq_work, which have trade-offs. The vulnerability is tracked as CVE-2026-53106 and categorized under CWE-401 (Improper Release of Memory).

The vulnerability can cause deadlocks in the kernel when local storage is deleted during NMI or reentrant calls, leading to potential denial of service (kernel hang or crash). There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

The vulnerability has been partially mitigated by adding checks that return errors when deletion of local storage is attempted in NMI contexts via bpf_xxx_storage_delete() helpers. A full mitigation requires further kernel changes that are not yet implemented. No official patch link or vendor advisory is provided in the data; therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.