Linux Kernel BPF LSM Hooks Sleepability Vulnerability

A vulnerability exists in the Linux kernel's handling of certain BPF LSM hooks, specifically 'task_to_inode' and 'inet_conn_established'. These hooks are not compatible with sleepable LSM programs due to being called under contexts that do not allow sleeping. The issue has been addressed by removing these hooks from the sleepable LSM context.

Impact

The vulnerability could lead to improper handling of LSM programs that require sleeping, potentially causing issues in security module operations that rely on these hooks.

Reproduction

The vulnerability can be reproduced by using sleepable LSM programs that interact with the 'task_to_inode' or 'inet_conn_established' hooks. The incompatibility will manifest as the hooks not functioning correctly within the sleepable context.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the official Linux kernel website.