CVE-2026-98384

A moderate-impact flaw was found in the Linux kernel BPF subsystem in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9 kernels shipped with OpenShift Container Platform 4.19 and later. The bpf_sock_destroy() BPF helper reads the sk_protocol field, which exists only in the full struct sock, but the TCP BPF iterator can hand it a timewait or request socket, which is based on the smaller struct sock_common. Reading sk_protocol past the end of such an object causes a two-byte slab out-of-bounds read that can crash the kernel, resulting in a denial of service. Exploitation requires local access with authorization to load and execute BPF programs, and the read value is not returned to user space, so Red Hat rates this flaw as Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 7 and 8, the earlier RHEL 9 streams 9.2 and 9.4, and OpenShift Container Platform 4.18 and earlier are not affected because the vulnerable bpf_sock_destroy kfunc is not present in those kernels. For the affected streams the fix is deferred to a future regularly scheduled kernel update; the residual risk is limited to local denial of service by a user who already holds the privileges required to run BPF programs, with no direct information disclosure or privilege escalation demonstrated.