CVE-2026-98043
Description
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. The verifier incorrectly assumes that certain pointer types are non-null without accounting for unbounded offsets that can wrap around to zero at runtime. A local user with permissions to load BPF programs can exploit this flaw by submitting a crafted program, triggering a null pointer dereference that crashes the system and results in a Denial of Service (DoS).
Statement
A moderate severity flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. The reg_not_null() helper decided that a register held a non-NULL value based on its pointer type alone, without considering that pointer arithmetic with an unbounded offset can wrap the value to zero at runtime. A local user with permission to load BPF programs could exploit this flaw by submitting a crafted BPF program that passes verifier checks and then dereferences a NULL map value pointer, triggering a NULL pointer dereference that crashes the kernel and results in a denial of service. Red Hat rates this flaw as Moderate (CVSS 3.1 score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and the ability to load BPF programs, and the impact is limited to system availability. The vulnerable code is present in the kernel and kernel-rt packages of Red Hat Enterprise Linux 8, 9, and 10, in Red Hat In-Vehicle OS, and in the RHEL CoreOS kernel shipped with OpenShift Container Platform 4 and 5; fixes for these products are deferred to a later update cycle, so the residual risk remains a local denial of service by a user who already holds the privileges required to load BPF programs. Red Hat Enterprise Linux 6 and 7 (including kernel-rt) are not affected because the vulnerable code is not present in those releases.
Mitigation
On systems where unprivileged users are able to load BPF programs, exposure to this flaw can be reduced by restricting BPF program loading to privileged users, for example by setting the sysctl kernel.unprivileged_bpf_disabled=1. Note that this does not prevent exploitation by a local user who already holds the privileges required to load BPF programs; such a user could still trigger the kernel crash. Mitigation for this issue is otherwise either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
