CVE-2026-98398

A LOW impact flaw was found in the Linux kernel's lock dependency validator (lockdep), affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, the kernel packages in Red Hat In-Vehicle OS, and the RHEL CoreOS kernels used by OpenShift Container Platform 4. When a lock class is removed, for example during kernel module unload or lock key unregistration, cached class pointers (class_cache entries) stored in existing lockdep_map structures are not invalidated. A local user can trigger lock acquisitions that reuse these stale references, resulting in an invalid class index and an inconsistent lock tracking state. This leads to lockdep DEBUG_LOCKS_WARN_ON kernel warnings, can disable lock validation, and can potentially cause a denial of service through a system crash on systems configured to panic on warnings. Confidentiality and integrity are not affected: the demonstrated effect is stale lockdep diagnostic metadata rather than a memory corruption or arbitrary write primitive, which is why Red Hat rates the impact of this flaw as LOW even though the CVSS 3.1 base score of 5.5 reflects a high availability impact. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels. Because this issue is confined to the lockdep debugging infrastructure, does not provide a memory corruption or privilege escalation primitive, and the stale state arises from operations such as module unloading or lock key unregistration, the fix is currently deferred for the affected products. The residual risk of deferring the fix is limited to lockdep warnings, disabled lock validation, and a possible kernel crash (denial of service), particularly on systems configured with panic_on_warn.