CVE-2026-98234

A low impact vulnerability was found in the Linux kernel's Heavy-Hitter Filter (HHF) network packet scheduler as shipped in Red Hat Enterprise Linux 8, including the RHEL CoreOS 8 kernel used in OpenShift Container Platform 4.12. The hh_flows_limit qdisc parameter (TCA_HHF_HH_FLOWS_LIMIT) was stored without an upper-bound check, so a local user with network administration privileges (CAP_NET_ADMIN, which an unprivileged user can obtain inside a user namespace or container) can configure an excessively large flow limit. When the system subsequently handles traffic containing many new flows, the kernel performs a fixed-size memory allocation for each newly classified heavy-hitter flow without an effective cap, allowing unbounded kernel memory consumption that can result in memory exhaustion, a system crash, and denial of service. The flaw provides no memory corruption, information disclosure, or privilege escalation primitive; its impact is limited to availability, and exploitation requires local access together with network administration privileges. For this reason Red Hat rates the impact as Low, lower than the Moderate severity indicated by the CVSS:3.1 base score of 5.5. The affected Red Hat Enterprise Linux 8 kernel and kernel-rt update streams and the RHEL CoreOS 8 component of OpenShift Container Platform 4.12 are currently marked affected with the fix deferred because of the low severity of this availability-only issue; the residual risk is that a local user holding the required privileges can still cause kernel memory exhaustion and denial of service on those systems. All other Red Hat products and update streams, including Red Hat Enterprise Linux 6, 7, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases based on RHEL CoreOS 9, are marked not affected because the vulnerable code is not present in their kernels.