{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-89991", "modified": "2026-10-07T14:35:31Z", "upstream": [ "CVE-2026-89991" ], "published": "2026-09-16T10:32:03Z", "summary": "bpf: Fix infinite loop in pcpu_freelist push with one possible CPU", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix infinite loop in pcpu_freelist push with one possible CPU\n\n__pcpu_freelist_push() can loop forever when only one CPU is possible\nand an NMI re-enters pcpu_freelist_push() while the interrupted context\nholds that CPU's freelist lock.\n\nAfter the current-CPU fast path fails, the fallback loop walks\ncpu_possible_mask while skipping the current CPU. With CONFIG_SMP=n, or\nwhen an SMP kernel is limited to one possible CPU with nr_cpus=1 or\npossible_cpus=1, there are no other possible CPUs to examine. The loop\ntherefore makes no lock acquisition attempt and can never make progress.\n\nThe following stack was observed on a UP system:\n\n NMI context:\n pcpu_freelist_push\n free_htab_elem\n htab_map_delete_elem\n [perf-event BPF program]\n __perf_event_overflow\n perf_event_nmi_handler\n exc_nmi\n\n Interrupted context:\n __pcpu_freelist_push\n pcpu_freelist_push\n free_htab_elem\n htab_map_delete_elem\n [raw_tp/sys_enter BPF program]\n __bpf_trace_sys_enter\n do_syscall_64\n\nraw_res_spin_lock() detects the same-CPU recursive acquisition and\nreturns -EDEADLK, but the subsequent fallback loop has no candidate head\non a system with one possible CPU.\n\nRestore the extra fallback head that existed before the rqspinlock\nconversion. Keep the current-CPU fast path, then try the other possible\nCPUs and finally the extra head. The additional head lets a push, which\ncannot fail without losing a preallocated element, make progress when the\nonly per-CPU head is held by the interrupted context.\n\nAlso check the extra head from the pop path so that nodes placed there\ncan be reused.", "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1", "1:6.18.50-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-2712", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v6", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v7", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt", "binary_version": "1:6.18.50-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.51" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.51" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.51" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.51" }, "1:6.18.50-1+rpt1": { "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7", "upstream_version": "6.18.50", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.51" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89991" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/a24a146ae2cb5d9faeea96d10010fcb6579abe1f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/a5b5e62baceff9e252c6535cf42a027d04f226cf" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/efebf6496685c93150df5bb0794363ae70c5f58a" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-16T10:32:03Z" } }