---
id: CVE-2026-98046
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Mark bpf_btf_find_by_name_kind() as sleepable

  When bpf_btf_find_by_name_kind() finds a type in module BTF, it
  returns a new BTF object fd through __btf_new_fd()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Mark bpf_btf_find_by_name_kind() as sleepable

  When bpf_btf_find_by_name_kind() finds a type in module BTF, it
  returns a new BTF object fd through __btf_new_fd(). …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1322
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3d78417b60fba249cc555468cb72d96f5cde2964 <
    7bf23cf7c9c0e0b5e638e497cdc0ec3f223742cc
  - >-
    Linux >= 3d78417b60fba249cc555468cb72d96f5cde2964 <
    b843ab43ac9d2fa1ddd0dab8d0dcc19dbf764e2f
  - >-
    Linux >= 3d78417b60fba249cc555468cb72d96f5cde2964 <
    29e40175617216fbd4544529f6bfb51d1ab95ba1
  - >-
    Linux >= 3d78417b60fba249cc555468cb72d96f5cde2964 <
    4d8784226bd3c6a707975081f986078f40456cec
  - >-
    Linux >= 3d78417b60fba249cc555468cb72d96f5cde2964 <
    17f54a8f2b9714529d56edbbe12d448ccdbbf469
  - >-
    Linux >= 3d78417b60fba249cc555468cb72d96f5cde2964 <
    620614bf7672130c43b3cff375525a2202f61979
  - Linux 5.14
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:26.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98046'
references:
  - url: 'https://git.kernel.org/stable/c/17f54a8f2b9714529d56edbbe12d448ccdbbf469'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/29e40175617216fbd4544529f6bfb51d1ab95ba1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d8784226bd3c6a707975081f986078f40456cec'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/620614bf7672130c43b3cff375525a2202f61979'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7bf23cf7c9c0e0b5e638e497cdc0ec3f223742cc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b843ab43ac9d2fa1ddd0dab8d0dcc19dbf764e2f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98046.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98046'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541185'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98046'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98046'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98046.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00173
epssPercentile: 0.06621
cvssSource: vendor
ingestedAt: '2026-09-25T11:06:38.847Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark bpf_btf_find_by_name_kind() as sleepable

When bpf_btf_find_by_name_kind() finds a type in module BTF, it
returns a new BTF object fd through __btf_new_fd(). This reaches
anon_inode_getfd(), which can sleep while allocating or expanding the
current task fd table.

The helper prototype does not set might_sleep, so the verifier allows
the helper in non-sleepable contexts such as BPF timer callbacks. The
fd allocation can then sleep in softirq context and install the fd into
the interrupted task.

Mark the helper as sleepable. This preserves calls from the main body
of a sleepable syscall program while rejecting calls from its
non-sleepable regions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98046.json)