CVE-2026-98045

A low impact denial of service flaw was found in the Linux kernel BPF subsystem as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases that use the RHEL 9 based coreos kernel. The faultable variants of the bpf_get_stack() and bpf_get_task_stack() helpers may block on filesystem reads while resolving user-space build IDs, but their prototypes were not marked as sleepable. Because the BPF verifier selects helper prototypes based on the sleepability of the whole program, these helpers could be invoked from non-sleepable atomic execution contexts within a sleepable program, such as explicit RCU read-side or preemption-disabled regions, or from a non-sleepable timer callback. A local user with the privileges required to load BPF programs could exploit this flaw to trigger sleeping in an atomic context, causing a kernel crash or hang and resulting in denial of service. This flaw was introduced upstream in kernel 6.12, so Red Hat Enterprise Linux 6, 7, and 8, and the RHEL 9.2 and 9.4 update streams, are not affected because the vulnerable code is not present. Red Hat rates the severity of this flaw as low because exploitation requires local access with elevated BPF-related privileges and the impact is limited to system availability, even though the CVSS:3.1 base score is 5.5 (moderate). For the affected products the fix is deferred to a future update; the residual risk is limited to local denial of service by an already-privileged user who is able to load BPF programs.