In the Linux kernel a helper function that can sleep was not marked as such, allowing it to be invoked in contexts where sleeping is prohibited. When bpf_btf_find_by_name_kind() returns a file descriptor through __btf_new_fd(), the helper may trigger anon_inode_getfd(), which can sleep while allocating or expanding the current task fd table. Because the helper’s prototype did not indicate a can‑sleep property, the BPF verifier allowed the helper to run inside non‑sleepable regions such as timer callbacks. The resulting sleep can occur in a softirq context, potentially causing a scheduler mis‑behavior, system hang or crash. The flaw was mitigated by marking the helper as sleepable, restoring correct verification behavior while permitting use in legitimate sleepable contexts.

The affected product is the Linux operating system kernel. No specific version range is provided in the data, so the scope of impact remains uncertain and may apply to any kernel containing the unmarked bpf_btf_find_by_name_kind() implementation.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% suggests a low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. The exploit would require an attacker to load a BPF program that calls the vulnerable helper in a non‑sleepable context, such as a timer callback or high‑priority task. Based on the description, the attack vector is likely via legitimate application or kernel module interfaces that use BPF, but no direct exploitation proof exists in the provided data.