CVE-2026-64352

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.0

Description An issue exists in the Linux kernel where sleepable BPF programs cannot properly access Longest Prefix Match (LPM) maps. The function trie lookup elem() uses an annotation that only validates classic RCU readers and XDP/NAPI contexts, failing for sleepable BPF programs that enter via bpf prog enter sleepable() and hold rcu read lock trace(). Similarly, trie update elem() and trie delete elem() use plain rcu dereference(), which unconditionally asserts rcu read lock held(). These functions are reachable via bpf map update elem and bpf map delete elem helpers. On debug kernels, a sleepable Linux Security Module (LSM) hook interacting with an LPM trie triggers lockdep, resulting in console spam. This is a lockdep-only issue and does not lead to Use-After-Free (UAF) because Tasks Trace RCU serializes against the trie reclaim path.

Recommendations Update the Linux kernel to version 7.1.0 or later.