CVE-2026-98646

In the Linux kernel, the following vulnerability has been resolved:

tcp: Skip cond resched() in inet csk listen stop() under BPF context

bpf sock destroy() runs from the tcp iterator, under rcu read lock(). If the sock is a listener that still has children in its accept queue, tcp abort() ends up in inet csk listen stop() and the cond resched() there trips the debug check:

BUG: sleeping function called from invalid context at net/ipv4/inet connection sock.c:1523 in atomic(): 0, irqs disabled(): 0, non block: 0, pid: 628, name: test progs preempt count: 0, expected: 0 RCU nest depth: 1, expected: 0 locks held by test progs/628: 3, last CPU#3: #0: ffff8881158cee18 (&p->lock){+.+.}-{4:4}, at: bpf seq read+0x56/0x1210 #1: ffff8881106bb858 (sk lock-AF INET6){+.+.}-{0:0}, at: bpf iter tcp seq show+0x32b/0x4b0 #2: ffffffffb435af20 (rcu read lock){....}-{1:3}, at: bpf iter run prog+0x46b/0xde0 CPU: 3 UID: 0 PID: 628 Comm: test progs Tainted: G W 7.2.0+ #65 PREEMPT Tainted: [W]=WARN Call Trace: dump stack lvl+0xc1/0xf0 dump stack+0x10/0x20 might resched+0x3d2/0x610 inet csk listen stop+0x7b/0xbf0 tcp abort+0x23b/0x3b0 bpf sock destroy+0xfc/0x140 bpf prog 448133d24601754f iter tcp6 server+0x81/0x8a bpf iter run prog+0x538/0xde0 bpf iter tcp seq show+0x26b/0x4b0 bpf seq read+0x424/0x1210 vfs read+0x197/0xe40 ksys read+0x119/0x240 x64 sys read+0x72/0xc0 x64 sys call+0x647/0x27e0 do syscall 64+0xe5/0x610 entry SYSCALL 64 after hwframe+0x76/0x7e RIP: 0033:0x7fad39b28aca RSP: 002b:00007ffc381c61c0 EFLAGS: 00000246 ORIG RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007ffc381c6a88 RCX: 00007fad39b28aca RDX: 0000000000000032 RSI: 00007ffc381c6250 RDI: 0000000000000014 RBP: 00007ffc381c61e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 000055f077c1bbb0 R15: 00007fad3a0f3000

The commit that added the kfunc already guards lock sock() in tcp abort() and udp abort() with has current bpf ctx(), but missed the listener path. Do the same for the cond resched(). The loop runs inside the iterator's rcu read lock(), it must not reschedule or report a quiescent state there.