CVE-2026-53106
Description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Do not allow deleting local storage in NMI
Currently, local storage may deadlock when deferring freeing selem or
local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace()
in NMI or reentrant. Since deleting selem in NMI is an unlikely use
case, partially mitigate it by returning error when calling from
bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible
to deadlock through reentrant. A full mitigation requires returning
error when irqs_disabled() is true, which, however is too heavy-handed
for bpf_xxx_storage_delete().
The long-term solution requires _nolock versions of call_rcu. Another
possible solution is to defer the free through irq_work [0], but it
would grow the size of selem, which is non-ideal.
The check is only needed in bpf_selem_unlink(), which is used by helpers
and syscalls. bpf_selem_unlink_nofail() is fine as it is called during
map and owner tear down that never run in NMI or reentrant.
[0] https://lore.kernel.org/bpf/20260205190233.912-1-alexei.starovoitov@gmail.com/
Summary dbcve.org
The Linux kernel's BPF subsystem has a deadlock vulnerability in local storage deletion. When bpf_xxx_storage_delete() helpers are called from NMI (Non-Maskable Interrupt) contexts or reentrantly, the use of kfree_rcu(), call_rcu(), or call_rcu_tasks_trace() can deadlock. The patch adds a check in bpf_selem_unlink() to return an error when called from NMI, preventing the deadlock condition.
Mitigation
Apply the kernel patch to add NMI context checking in bpf_selem_unlink(). This prevents BPF local storage deletion from NMI contexts which would otherwise cause deadlocks. Note that reentrant calls are not fully mitigated.