CVE-2026-97906

A flaw was found in the Linux kernel's boot configuration (bootconfig) handling of the initial RAM disk (initrd). Red Hat Product Security has rated this issue as having LOW security impact. In get_boot_config_from_initrd(), a crafted initrd with an oversized bootconfig size value can cause pointer arithmetic to wrap around, bypassing the initrd bounds check. The kernel then calls xbc_calc_checksum() with an invalid address and an attacker-controlled length, reading unmapped memory and triggering a fatal kernel page fault during early boot, resulting in a denial of service. Exploiting this flaw requires the ability to supply or modify the initrd or another trusted boot artifact, which typically requires root, bootloader, or provisioning-infrastructure control; the issue is not reachable by an unprivileged local user and has no confidentiality or integrity impact. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact as LOW because reliable triggering requires control of trusted boot artifacts. Red Hat Enterprise Linux 9 and 10 (including the kernel and kernel-rt packages), Red Hat In-Vehicle OS 2, and OpenShift Container Platform versions based on RHEL CoreOS 9 are affected; the fix is currently deferred to a future update because of the low risk, and the residual risk is limited to a denial of service at boot by an attacker who already controls the system's boot environment. Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform 4.12 (based on RHEL CoreOS 8) are not affected because the vulnerable code is not present in those releases.