CVE-2026-98402
Description
A flaw was found in the Linux kernel. An attacker could cause a Denial of Service (DoS) or system instability by triggering network error events while kernel event tracing is active. When recording Internet Control Message Protocol (ICMP) messages, the kernel attempts to read transport header information without verifying that the packet header is initialized and valid, leading to an invalid memory read that can crash the system.
Statement
A low impact flaw was found in the Linux kernel's ICMP event tracing. When the icmp:icmp_send tracepoint is active, an attacker who can trigger network error paths that reach __icmp_send() (for example link failures, ARP errors, forwarding, or AF_PACKET) can cause the tracepoint to read UDP transport header information without first verifying that the packet is UDP and that its transport header was initialized, resulting in an invalid memory read. The demonstrated impact is a kernel WARNING under CONFIG_DEBUG_NET=y, which can escalate to a system crash and denial of service on systems configured to panic on warnings; only availability is affected. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected, with fixes currently deferred because the vulnerable path requires the non-default icmp:icmp_send tracepoint to be enabled and the assessed impact is low, leaving residual risk only for systems running such event tracing. RHEL 7, 8, and 9 (including kernel-rt) and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present in those kernels; RHEL 6 ELS is out of support scope. Red Hat assessed this flaw as Low impact despite the CVSS:3.1 score of 5.5 (Moderate), because reliable exploitation requires the non-default diagnostic configuration of active ICMP event tracing.
Mitigation
The vulnerable code is only executed when the icmp:icmp_send kernel tracepoint is enabled, which is not a default configuration. On affected kernels, disabling the icmp:icmp_send tracepoint (or not enabling ICMP event tracing) prevents the invalid transport header access. Where event tracing must remain enabled, ensuring the kernel does not panic on warnings (for example by booting or setting panic_on_warn=0) limits the demonstrated impact to a kernel warning rather than a system crash.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
