CVE-2026-97420

A moderate-impact flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem in kernel/bpf/cgroup.c, affecting Red Hat Enterprise Linux kernel packages (kernel, kernel-rt) and other affected Red Hat kernel-based offerings recorded on this flaw. When a cgroup sysctl BPF program calls the bpf_sysctl_set_new_value() helper to replace a pending sysctl value, the helper copies only the replacement buffer length without appending a terminating NUL byte. Sysctl proc handlers and their downstream string parsers expect a NUL-terminated buffer and may read past the end of the allocated page or slab, resulting in an out-of-bounds read (observed as a KASAN slab-out-of-bounds read in strnchrnul via bitmap_parse and flow_limit_cpu_sysctl). A local user with the privileges required to write to sysctl entries and load and attach cgroup sysctl BPF programs could exploit this flaw to crash the kernel, causing a denial of service; in the worst case an out-of-bounds read could expose kernel memory, although no information disclosure or write primitive is demonstrated. The flaw is rated Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local, privileged access and the primary consequence is loss of availability.