In the Linux kernel, the following vulnerability has been resolved: tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context… (CVE-2026-98646)

The vulnerability in the Linux kernel relates to the TCP stack where cond_resched() is called inside inet_csk_listen_stop() during the execution of bpf_sock_destroy() under BPF context. Since bpf_sock_destroy() runs under rcu_read_lock(), calling cond_resched() leads to a BUG triggered by a sleeping function call from an invalid context. The root cause is that the listener path in tcp_abort() was not guarded by has_current_bpf_ctx(), unlike other abort paths. The patch adds this guard to skip cond_resched() in the listener path, preventing rescheduling within the iterator's rcu_read_lock() context and avoiding the debug check failure.

This vulnerability causes a kernel BUG due to an invalid sleeping function call in a context that forbids sleeping, which can lead to kernel warnings or crashes when BPF programs interact with TCP listeners. It affects system stability under specific BPF socket destruction scenarios but does not indicate direct privilege escalation or code execution.

A fix has been implemented in the Linux kernel to skip cond_resched() in inet_csk_listen_stop() under BPF context. Users should update their Linux kernel to a version that includes this patch to prevent the kernel BUG from occurring. No additional mitigation is required beyond applying the official fix.