Skip to content
OpenAdvisories
Unscored CVE-2023-53857 EUVD-2023-60139GHSA-rqrg-f936-7vv9

bpf: bpf_sk_storage: Fix invalid wait context lockdep report

Published Dec 9, 2025 · Updated Oct 3, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia-6.11 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: bpf_sk_storage: Fix invalid wait context lockdep report

'./test_progs -t test_local_storage' reported a splat:

[ 27.137569] =============================
[ 27.138122] [ BUG: Invalid wait context ]
[ 27.138650] 6.5.0-03980-gd11ae1b16b0a #247 Tainted: G O
[ 27.139542] -----------------------------
[ 27.140106] test_progs/1729 is trying to lock:
[ 27.140713] ffff8883ef047b88 (stock_lock){-.-.}-{3:3}, at: local_lock_acquire+0x9/0x130
[ 27.141834] other info that might help us debug this:
[ 27.142437] context-{5:5}
[ 27.142856] 2 locks held by test_progs/1729:
[ 27.143352] #0: ffffffff84bcd9c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x40
[ 27.144492] #1: ffff888107deb2c0 (&storage->lock){..-.}-{2:2}, at: bpf_local_storage_update+0x39e/0x8e0
[ 27.145855] stack backtrace:
[ 27.146274] CPU: 0 PID: 1729 Comm: test_progs Tainted: G O 6.5.0-03980-gd11ae1b16b0a #247
[ 27.147550] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 27.149127] Call Trace:
[ 27.149490] <TASK>
[ 27.149867] dump_stack_lvl+0x130/0x1d0
[ 27.152609] dump_stack+0x14/0x20
[ 27.153131] __lock_acquire+0x1657/0x2220
[ 27.153677] lock_acquire+0x1b8/0x510
[ 27.157908] local_lock_acquire+0x29/0x130
[ 27.159048] obj_cgroup_charge+0xf4/0x3c0
[ 27.160794] slab_pre_alloc_hook+0x28e/0x2b0
[ 27.161931] __kmem_cache_alloc_node+0x51/0x210
[ 27.163557] __kmalloc+0xaa/0x210
[ 27.164593] bpf_map_kzalloc+0xbc/0x170
[ 27.165147] bpf_selem_alloc+0x130/0x510
[ 27.166295] bpf_local_storage_update+0x5aa/0x8e0
[ 27.167042] bpf_fd_sk_storage_update_elem+0xdb/0x1a0
[ 27.169199] bpf_map_update_value+0x415/0x4f0
[ 27.169871] map_update_elem+0x413/0x550
[ 27.170330] __sys_bpf+0x5e9/0x640
[ 27.174065] __x64_sys_bpf+0x80/0x90
[ 27.174568] do_syscall_64+0x48/0xa0
[ 27.175201] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 27.175932] RIP: 0033:0x7effb40e41ad
[ 27.176357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d8
[ 27.179028] RSP: 002b:00007ffe64c21fc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000141
[ 27.180088] RAX: ffffffffffffffda RBX: 00007ffe64c22768 RCX: 00007effb40e41ad
[ 27.181082] RDX: 0000000000000020 RSI: 00007ffe64c22008 RDI: 0000000000000002
[ 27.182030] RBP: 00007ffe64c21ff0 R08: 0000000000000000 R09: 00007ffe64c22788
[ 27.183038] R10: 0000000000000064 R11: 0000000000000202 R12: 0000000000000000
[ 27.184006] R13: 00007ffe64c22788 R14: 00007effb42a1000 R15: 0000000000000000
[ 27.184958] </TASK>

It complains about acquiring a local_lock while holding a raw_spin_lock.
It means it should not allocate memory while holding a raw_spin_lock
since it is not safe for RT.

raw_spin_lock is needed because bpf_local_storage supports tracing
context. In particular for task local storage, it is easy to
get a "current" task PTR_TO_BTF_ID in tracing bpf prog.
However, task (and cgroup) local storage has already been moved to
bpf mem allocator which can be used after raw_spin_lock.

The splat is for the sk storage. For sk (and inode) storage,
it has not been moved to bpf mem allocator. Using raw_spin_lock or not,
kzalloc(GFP_ATOMIC) could theoretically be unsafe in tracing context.
However, the local storage helper requires a verifier accepted
sk pointer (PTR_TO_BTF_ID), it is hypothetical if that (mean running
a bpf prog in a kzalloc unsafe context and also able to hold a verifier
accepted sk pointer) could happen.

This patch avoids kzalloc after raw_spin_lock to silent the splat.
There is an existing kzalloc before the raw_spin_lock. At that point,
a kzalloc is very likely required because a lookup has just been done
before. Thus, this patch always does the kzalloc before acq
---truncated---

Affected products

VendorProductAffectedFixed
Linux Linux 5.18 6.1.189

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.5.6-1 —
Debian 13 linux 6.5.6-1 —
Debian 12 linux 6.1.190-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-riscv +10 No fix yet —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
ReleasePackageFixed inAdvisory
RHEL 9 bpftool 7.3.0-427.13.1.el9_4 RHSA-2024:2394
RHEL 9 rv +64 5.14.0-427.13.1.el9_4 RHSA-2024:2394
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +6 6.4.0-150700.53.28.1 SUSE-SU-2026:0315-1
SLES 15 SP7 kernel-azure +2 6.4.0-150700.20.24.1 SUSE-SU-2026:0281-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.28.1.150700.17.19.1 SUSE-SU-2026:0315-1
SLES 15 SP6 kernel-64kb +6 6.4.0-150600.23.84.1 SUSE-SU-2026:0293-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.84.1.150600.12.38.1 SUSE-SU-2026:0293-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 kernel-default-base 6.4.0-150600.23.84.1.150600.12.38.1 SUSE-SU-2026:0293-1
SLES for SAP 15 SP6 kernel-docs +4 6.4.0-150600.23.84.1 SUSE-SU-2026:0293-1
SLE Micro 6.1 kernel-default-base 6.4.0-39.1.21.16 SUSE-SU-2026:20498-1
SLE Micro 6.1 kernel-rt +1 6.4.0-40.1 SUSE-SU-2026:20876-1
SLE Micro 6.1 kernel-source +2 6.4.0-39.1 SUSE-SU-2026:20498-1
SLE Micro 6.0 kernel-default-base 6.4.0-39.1.21.16 SUSE-SU-2026:20477-1
SLE Micro 6.0 kernel-rt +1 6.4.0-40.1 SUSE-SU-2026:20845-1
SLE Micro 6.0 kernel-source +2 6.4.0-39.1 SUSE-SU-2026:20477-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.28.1 SUSE-SU-2026:0315-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_8 1-150700.1.3.1 SUSE-SU-2026:0278-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_8 1-150700.15.3.1 SUSE-SU-2026:0315-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.84.1 SUSE-SU-2026:0293-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_19 1-150600.13.3.1 SUSE-SU-2026:0293-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.28.1 SUSE-SU-2026:0278-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 dtb-aarch64 +10 6.4.0-150600.23.84.1 SUSE-SU-2026:0293-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.84.1.150600.12.38.1 SUSE-SU-2026:0293-1

Advisories 10

References