CVE-2026-90247
Description
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component. This vulnerability allows for a memory map (mmap) lock to be leaked when handling interrupt work, specifically within the stack_map_get_build_id_offset() and bpf_find_vma() functions. This can lead to a situation where two read locks are acquired but only one is released, ultimately blocking the system's ability to exit memory map operations. The most significant consequence of this flaw is a denial of service (DoS), which can prevent legitimate users from accessing system resources.
Statement
A moderate severity denial of service flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem, affecting the kernel packages shipped in Red Hat Enterprise Linux 8, 9, and 10 (including the kernel-rt variants), Red Hat In-Vehicle OS 2, and the Red Hat CoreOS container images used by OpenShift Container Platform 4. In the irq_work path that defers mmap_read_unlock() out of NMI context, stack_map_get_build_id_offset() and bpf_find_vma() reuse the same per-CPU mmap_unlock_work slot and only check whether that work is busy before taking the mmap read lock. A nested caller can therefore reuse the slot before the first caller queues it, resulting in two read locks being acquired while only one deferred unlock runs. The leaked read lock blocks exit_mmap(), so a local user with low privileges able to reach these BPF code paths can hang the affected system, causing a denial of service. Red Hat scored this flaw CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local attack vector with availability-only impact. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels. The fix is deferred for the affected streams and is planned to be delivered in a future kernel update; the residual risk is limited to local denial of service, with no impact on confidentiality or integrity.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
