CVE-2026-98058

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark syscall helpers as sleepable

bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes,

allocate with GFP_KERNEL, and wait for an RCU grace period.

bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as

well.

Both helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is

sleepable. That does not make every callback sleepable: a syscall program

can register a bpf_timer callback, and the verifier checks that callback

in a non-sleepable context while retaining the syscall helper set.

Without .might_sleep on the prototypes, such a callback can invoke

bpf_sys_bpf() from hrtimer softirq context and trigger a

scheduling-while-atomic failure. bpf_sys_close() is exposed through the

same missing context check.

Set .might_sleep on both prototypes so the existing helper-context check

rejects them from timer callbacks and other atomic regions. Calls from the

sleepable main body remain valid.