Medium 5.5Published May 1, 2026

CVE-2026-43010bpf: Reject sleepable kprobe_multi programs at attach time

Updated under an hour ago (Oct 26, 2026, 1:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable kprobe_multi programs at attach time kprobe.multi programs run in atomic/RCU context and cannot sleep. However, bpf_kprobe_multi_link_attach() did not validate whether the program being attached had the sleepable flag set, allowing sleepable helpers such as bpf_copy_from_user() to be invoked from a non-sleepable context. This causes a "sleeping function called from invalid context" splat: BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo preempt_count: 1, expected: 0 RCU nest depth: 2, expected: 0 Fix this by rejecting sleepable programs early in bpf_kprobe_multi_link_attach(), before any further processing.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jul 4, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0dcac272540613d41c05e89679e4ddb978b612f1 before 89327ed787746a7aa4db3c97f91d2e294228932b; from 0dcac272540613d41c05e89679e4ddb978b612f1 before d97b19fe5265f7901b2c862f88a4eb1b129a0b61; from 0dcac272540613d41c05e89679e4ddb978b612f1 before dc9a060d76c12b23c5f378ee115d5e5d03d8bbf3; from 0dcac272540613d41c05e89679e4ddb978b612f1 before f952157e695fd434bdc05af63a703bb082a78717; from 0dcac272540613d41c05e89679e4ddb978b612f1 before eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8	CNA record
linux linux_kernel linux:linux_kernel	from 5.18 before 6.18.22; from 6.19 before 6.19.12; 7.0; 7.0; 7.0; 7.0; 7.0; 7.0	NVD

References

References

https://git.kernel.org/stable/c/89327ed787746a7aa4db3c97f91d2e294228932b
https://git.kernel.org/stable/c/d97b19fe5265f7901b2c862f88a4eb1b129a0b61
https://git.kernel.org/stable/c/dc9a060d76c12b23c5f378ee115d5e5d03d8bbf3	patch
https://git.kernel.org/stable/c/f952157e695fd434bdc05af63a703bb082a78717	patch
https://git.kernel.org/stable/c/eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.