CVE-2026-98045 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel configurations and BPF program usage should assess exposure and prioritize verification of Linux kernel configurations and BPF program usage. They should also verify sleepability of BPF helpers in use and assess exposure to potential blocking on filesystem reads. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update their configurations and

Why it matters

A vulnerability in the Linux kernel has been resolved, involving the bpf_get_stack() and bpf_get_task_stack() helpers. Defenders should assess exposure and prioritize verification of Linux kernel configurations and BPF program usage.

• Verification of Linux kernel configurations and BPF program usage is required
• Assessment of exposure to potential blocking on filesystem reads is necessary

Technical summary

The Linux kernel vulnerability involves the bpf_get_stack() and bpf_get_task_stack() helpers, which can block on filesystem reads. The faultable variants of these helpers pass may_fault=true to the common stack collection code, which can lead to blocking on filesystem reads. The prototypes of these helpers were not marked as sleepable. This could allow them to be called from non-sleepable regions within a program. Defenders should assess exposure and prioritize verification of Linux kernel configurations and BPF program usage. The issue arises because the faultable variants of these helpers pass may_fault=true to the common stack collection code, which can lead to blocking on filesystem reads.

Defensive priority

Defenders should assess exposure and prioritize verification of Linux kernel configurations and BPF program usage.

Recommended defensive actions

• Assess Linux kernel configurations and BPF program usage
• Verify sleepability of BPF helpers in use
• Monitor for updates on Linux kernel patches
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected systems and versions requires verification from official sources. Linux kernel configurations and BPF program usage should be verified for potential exposure. The faultable variants of bpf_get_stack() and bpf_get_task_stack() helpers pass may_fault=true to the common stack collection code, which can lead to blocking on filesystem reads. Defenders should verify sleepability of BPF helpers in use and assess exposure to potential blocking on

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.