---
id: CVE-2026-90247
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix mmap_lock leak in irq_work path

  stack_map_get_build_id_offset() introduced a per-CPU irq_work to defer
  mmap_read_unlock() from NMI context, and bpf_find_vma()…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix mmap_lock leak in irq_work path

  stack_map_get_build_id_offset() introduced a per-CPU irq_work to defer
  mmap_read_unlock() from NMI context, and bpf_find_vma()…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eac9153f2b584c702cea02c1f1a57d85aa9aea42 <
    a052ad5edccf5319f50ed955de4368f8318a9f20
  - >-
    Linux >= eac9153f2b584c702cea02c1f1a57d85aa9aea42 <
    051f2da26ce377f683b938a3382e0f16d02f3139
  - >-
    Linux >= eac9153f2b584c702cea02c1f1a57d85aa9aea42 <
    fa9dcacdcdf487f0ffef64bf67622f1caed509f1
  - Linux a7f4da875c16f3b8bef0d9ec67528111045bfcd8
  - Linux f1838da73cccb238b8be4ef464fce0168dc7ba84
  - Linux >= 4.19.92 < 4.20
  - Linux >= 5.4.7 < 5.5
  - Linux 5.5
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:20.803'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90247'
references:
  - url: 'https://git.kernel.org/stable/c/051f2da26ce377f683b938a3382e0f16d02f3139'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a052ad5edccf5319f50ed955de4368f8318a9f20'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fa9dcacdcdf487f0ffef64bf67622f1caed509f1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.845Z'
epss: 0.00206
epssPercentile: 0.09467
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix mmap_lock leak in irq_work path

stack_map_get_build_id_offset() introduced a per-CPU irq_work to defer
mmap_read_unlock() from NMI context, and bpf_find_vma() later reused the
same mmap_unlock_work. Both callers only check whether the work is busy
before taking mmap_lock, so a nested caller can reuse the slot before the
first caller queues it. Two read locks may then be acquired while only one
deferred unlock runs, leaking a read lock and blocking exit_mmap().

Reserve the per-CPU slot before mmap_read_trylock(). Use the same wrapper
in stackmap and bpf_find_vma() so both callers release the reservation on
trylock failure. Keep rejecting the slot while the irq_work remains busy.
Release it after the irq_work callback unlocks the mm.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.