CVE-2026-98075
Description
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF program references its main function as a callback, the kernel fails to translate the function reference into a valid memory address. A local user with permissions to load BPF programs could exploit this vulnerability by invoking the unresolved reference, causing a kernel crash and a Denial of Service (DoS).
Statement
The BPF verifier can accept a BPF_PSEUDO_FUNC reference to the main program even though this reference is not rewritten to a real function address when no additional subprogram exists. A program can pass the resulting bogus function pointer to bpf_timer_set_callback or a similar callback interface and cause the kernel to perform an indirect call through an invalid address. The directly supported impact is a local kernel crash and denial of service. The invalid indirect call also creates a potential control flow primitive that may have greater confidentiality and integrity impact if the target address can be influenced reliably. For the CVSS the PR:L value is used because a local process must load the crafted BPF program and must have the BPF access granted by the system policy. The issue is not network reachable. The paranoid assessment uses AC:H and CIA:HHH because privilege escalation would require additional control over the unresolved address and kernel execution layout.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
