ZeroDay Findings
Sign inSign up

Findings

CVE-2025-39886

In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling bpf_map_kmalloc_node() f

Published Sep 23, 2025 · updated Oct 14, 2026

In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling bpf_map_kmalloc_node() from __bpf_async_init() can cause various locking issues; see the following stack trace (edited for style) as one example: ... [10.011566] do_raw_spin_lock.cold [10.011570] try_to_wake_up (5) double-acquiring the same [10.011575] kick_pool rq_lock, causing a hardlockup [10.011579] __queue_work [10.011582] queue_work_on [10.011585] kernfs_notify [10.011589] cgroup_file_notify [10.011593] try_charge_memcg (4) memcg accounting raises an [10.011597] obj_cgroup_charge_pages MEMCG_MAX event [10.011599] obj_cgroup_charge_account [10.011600] __memcg_slab_post_alloc_hook [10.011603] __kmalloc_node_noprof ... [10.011611] bpf_map_kmalloc_node [10.011612] __bpf_async_init [10.011615] bpf_timer_init (3) BPF calls bpf_timer_init() [10.011617] bpf_prog_xxxxxxxxxxxxxxxx_fcg_runnable [10.011619] bpf__sched_ext_ops_runnable [10.011620] enqueue_task_scx (2) BPF runs with rq_lock held [10.011622] enqueue_task [10.011626] ttwu_do_activate [10.011629] sched_ttwu_pending (1) grabs rq_lock ... The above was reproduced on bpf-next (b338cf849ec8) by modifying ./tools/sched_ext/scx_flatcg.bpf.c to call bpf_timer_init() during ops.runnable(), and hacking the memcg accounting code a bit to make a bpf_timer_init() call more likely to raise an MEMCG_MAX event. We have also run into other similar variants (both internally and on bpf-next), including double-acquiring cgroup_file_kn_lock, the same worker_pool::lock, etc. As suggested by Shakeel, fix this by using __GFP_HIGH instead of GFP_ATOMIC in __bpf_async_init(), so that e.g. if try_charge_memcg() raises an MEMCG_MAX event, we call __memcg_memory_event() with @allow_spinning=false and avoid calling cgroup_file_notify() there. Depends on mm patch "memcg: skip cgroup_file_notify if spinning is not allowed": https://lore.kernel.org/bpf/20250905201606.66198-1-shakeel.butt@

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 23, 2025 · OSV.dev

    Detected

    In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling bpf_map_kmalloc_node() from __bpf_async_init() can cause various locking issues; see the following stack trace (edited for style) as one example: ... [10.011566] do_raw_spin_lock.cold [10.011570] try_to_wake_up (5) double-acquiring the same [10

  2. Oct 14, 2026 · OSV.dev

    Fix available

    linux-aws-6.8 fixed in 6.8.0-1050.53~22.04.1; linux-azure-6.8 fixed in 6.8.0-1051.57~22.04.1; linux-azure-fde-6.8 fixed in 6.8.0-1058.65~22.04.1; linux-gcp-6.8 fixed in 6.8.0-1052.55~22.04.1

  3. Oct 14, 2026 · OSV.dev

    Updated

    In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling bpf_map_kmalloc_node() from __bpf_async_init() can cause various locking issues; see the following stack trace (edited for style) as one example: ... [10.011566] do_raw_spin_lock.cold [10.011570] try_to_wake_up (5) double-acquiring the same [10

Affected

  • Ubuntu:16.04:LTS linux-hwe-edge4.8.0-28.30~16.04.1, 4.8.0-30.32~16.04.1, 4.8.0-32.34~16.04.1
  • Ubuntu:18.04:LTS linux-aws-5.05.0.0-1021.24~18.04.1, 5.0.0-1022.25~18.04.1, 5.0.0-1023.26~18.04.1
  • Ubuntu:18.04:LTS linux-aws-5.35.3.0-1016.17~18.04.1, 5.3.0-1017.18~18.04.1, 5.3.0-1019.21~18.04.1
  • Ubuntu:18.04:LTS linux-azure4.15.0-1002.2, 4.15.0-1003.3, 4.15.0-1004.4
  • Ubuntu:18.04:LTS linux-azure-5.35.3.0-1007.8~18.04.1, 5.3.0-1008.9~18.04.1, 5.3.0-1009.10~18.04.1
  • Ubuntu:18.04:LTS linux-azure-edge4.18.0-1006.6~18.04.1, 4.18.0-1007.7~18.04.1, 4.18.0-1008.8~18.04.1
  • Ubuntu:18.04:LTS linux-gcp4.15.0-1001.1, 4.15.0-1003.3, 4.15.0-1005.5
  • Ubuntu:18.04:LTS linux-gcp-5.35.3.0-1008.9~18.04.1, 5.3.0-1009.10~18.04.1, 5.3.0-1010.11~18.04.1
  • Ubuntu:18.04:LTS linux-gke-4.154.15.0-1030.32, 4.15.0-1032.34, 4.15.0-1033.35
  • Ubuntu:18.04:LTS linux-gke-5.45.4.0-1025.25~18.04.1, 5.4.0-1027.28~18.04.1, 5.4.0-1029.31~18.04.1
  • Ubuntu:18.04:LTS linux-gkeop-5.45.4.0-1001.1, 5.4.0-1003.3, 5.4.0-1004.5
  • Ubuntu:18.04:LTS linux-hwe4.18.0-13.14~18.04.1, 4.18.0-14.15~18.04.1, 4.18.0-15.16~18.04.1

Sources

References

CVE-2025-39886 · ZeroDay Findings