CVE-2026-98007
Description
A flaw was found in the Linux kernel. A privileged local user can cause a Denial of Service (DoS) by loading a specially crafted BPF (Berkeley Packet Filter) program that passes a pointer value instead of a scalar number as the loop iteration count to the bpf_loop function. Because the kernel's BPF verifier does not strictly enforce scalar arguments for this parameter, an internal tracking failure triggers a kernel warning. On systems configured to panic on warnings, this condition leads to an immediate kernel crash.
Statement
A low impact denial of service flaw was found in the Linux kernel BPF subsystem, affecting the kernel packages in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.19 and later releases that ship the RHEL CoreOS 9 kernel. The bpf_loop() helper accepted any value for its nr_loops argument, so a privileged local user with the ability to load BPF programs could pass a pointer where a scalar iteration count was expected. Because BPF verifier precision backtracking only supports scalar registers, this triggers an internal verifier warning; on systems configured with panic_on_warn, the warning causes an immediate kernel panic and denial of service. Only availability is impacted, and exploitation requires high local privileges to load a crafted BPF program, so this flaw is rated low impact.
Older streams, including Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 and 9.4 update streams, the corresponding kernel-rt builds, and OpenShift versions based on RHEL CoreOS 8, are not affected because the vulnerable code is not present in those kernels; the flaw was introduced by the upstream change that began tracking the maximum number of bpf_loop callback iterations.
For the affected streams the fix is deferred to a future update because of the low impact of this flaw and the high privileges required for exploitation. The residual risk is a local denial of service limited to systems where a privileged user can load BPF programs and panic_on_warn is enabled.
Mitigation
This flaw causes a kernel crash only on systems configured to panic on warnings. As a workaround, disable panic_on_warn to prevent the BPF verifier warning from escalating to a kernel panic, for example with 'sysctl -w kernel.panic_on_warn=0' or by adding 'kernel.panic_on_warn=0' to the kernel command line. The underlying verifier warning will still be emitted, and no other mitigation meeting Red Hat Product Security criteria is currently available; a permanent fix is deferred to a future kernel update.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, an attacker can still cause a denial of service if they can trigger an assert statement, and if the scope of the assert() extends beyond the attacker's own session. For example, if a server handles multiple simultaneous connections, if an assert() occurs in one single connection that causes all other connections to be dropped, this could be a significant denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
