CVE-2026-89991
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpu_freelist push with one possible CPU __pcpu_freelist_push() can loop forever when only one CPU is possible and an NMI re-enters pcpu_freelist_push() while the interrupted context holds that CPU's freelist lock. After the current-CPU fast path fails, the fallback loop walks cpu_possible_mask while skipping the current CPU. With CONFIG_SMP=n, or when an SMP kernel is limited to one possible CPU with nr_cpus=1 or possible_cpus=1, there are no other possible CPUs to examine. The loop therefore makes no lock acquisition attempt and can never make progress. The following stack was observed on a UP system: NMI context: pcpu_freelist_push free_htab_elem htab_map_delete_elem [perf-event BPF program] __perf_event_overflow perf_event_nmi_handler exc_nmi Interrupted context: __pcpu_freelist_push pcpu_freelist_push free_htab_elem htab_map_delete_elem [raw_tp/sys_enter BPF program] __bpf_trace_sys_enter do_syscall_64 raw_res_spin_lock() detects the same-CPU recursive acquisition and returns -EDEADLK, but the subsequent fallback loop has no candidate head on a system with one possible CPU. Restore the extra fallback head that existed before the rqspinlock conversion. Keep the current-CPU fast path, then try the other possible CPUs and finally the extra head. The additional head lets a push, which cannot fail without losing a preallocated element, make progress when the only per-CPU head is held by the interrupted context. Also check the extra head from the pop path so that nodes placed there can be reused.
View original CVE JSON
{
"id": "CVE-2026-89991",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-16T11:17:10.240",
"lastModified": "2026-10-19T09:18:46.253",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix infinite loop in pcpu_freelist push with one possible CPU\n\n__pcpu_freelist_push() can loop forever when only one CPU is possible\nand an NMI re-enters pcpu_freelist_push() while the interrupted context\nholds that CPU's freelist lock.\n\nAfter the current-CPU fast path fails, the fallback loop walks\ncpu_possible_mask while skipping the current CPU. With CONFIG_SMP=n, or\nwhen an SMP kernel is limited to one possible CPU with nr_cpus=1 or\npossible_cpus=1, there are no other possible CPUs to examine. The loop\ntherefore makes no lock acquisition attempt and can never make progress.\n\nThe following stack was observed on a UP system:\n\n NMI context:\n pcpu_freelist_push\n free_htab_elem\n htab_map_delete_elem\n [perf-event BPF program]\n __perf_event_overflow\n perf_event_nmi_handler\n exc_nmi\n\n Interrupted context:\n __pcpu_freelist_push\n pcpu_freelist_push\n free_htab_elem\n htab_map_delete_elem\n [raw_tp/sys_enter BPF program]\n __bpf_trace_sys_enter\n do_syscall_64\n\nraw_res_spin_lock() detects the same-CPU recursive acquisition and\nreturns -EDEADLK, but the subsequent fallback loop has no candidate head\non a system with one possible CPU.\n\nRestore the extra fallback head that existed before the rqspinlock\nconversion. Keep the current-CPU fast path, then try the other possible\nCPUs and finally the extra head. The additional head lets a push, which\ncannot fail without losing a preallocated element, make progress when the\nonly per-CPU head is held by the interrupted context.\n\nAlso check the extra head from the pop path so that nodes placed there\ncan be reused."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"kernel/bpf/percpu_freelist.c",
"kernel/bpf/percpu_freelist.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "f2ac0e5d1c4dcc55d6510dcaefb8f45661a9a1fb",
"lessThan": "a24a146ae2cb5d9faeea96d10010fcb6579abe1f",
"versionType": "git",
"status": "affected"
},
{
"version": "f2ac0e5d1c4dcc55d6510dcaefb8f45661a9a1fb",
"lessThan": "a5b5e62baceff9e252c6535cf42a027d04f226cf",
"versionType": "git",
"status": "affected"
},
{
"version": "f2ac0e5d1c4dcc55d6510dcaefb8f45661a9a1fb",
"lessThan": "efebf6496685c93150df5bb0794363ae70c5f58a",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"kernel/bpf/percpu_freelist.c",
"kernel/bpf/percpu_freelist.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.15",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.15",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.51",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.5",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/a24a146ae2cb5d9faeea96d10010fcb6579abe1f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a5b5e62baceff9e252c6535cf42a027d04f226cf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/efebf6496685c93150df5bb0794363ae70c5f58a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}