CVE-2026-97944

A low impact flaw was found in the Linux kernel FineIBT Control Flow Integrity (CFI) implementation. An open-coded offset in cfi_get_func_hash() reads the FineIBT hash from offset 7 of the function preamble even though the hash immediate now starts at offset 5. The BPF JIT uses this value to provide a struct_ops trampoline with the CFI hash of the stub function it stands in for, so the trampoline is assigned a corrupted hash. The first indirect call from the kernel into the BPF struct_ops program, for example tcp_init_congestion_control() invoking the ->init() operation of a BPF congestion control algorithm, then fails the FineIBT check and terminates the kernel with a fatal CFI failure, resulting in a local denial of service. Exploitation requires local access and the privileges needed to load and attach BPF struct_ops programs (for example CAP_BPF, CAP_SYS_ADMIN, or CAP_NET_ADMIN), and only configurations where FineIBT is enabled are affected. Red Hat Enterprise Linux 7, 8, 9, and 10 are marked not affected because the vulnerable code is not present in the shipped kernels. Red Hat Enterprise Linux 6 Extended Lifecycle Support is recorded as out of support scope for this issue. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact of this flaw as low because it requires local privileged access and only causes a denial of service.