CVE-2026-93138

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the bpf get btf vmlinux() function during the lazy parsing of vmlinux BTF (BPF Type Format). The function publishes the result using a plain store and re-checks it via a lockless load. On weakly ordered architectures, a concurrent caller might observe the pointer before the parsed contents of the struct btf inside btf parse vmlinux() are fully visible. This occurs because the mutex unlock() does not synchronize with lockless readers. To resolve this, the pointer must be published using smp store release() and read using smp load acquire() to ensure proper memory ordering for both the returned object and associated globals, such as bpf ctx convert.t.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.