CVE-2026-98613
Description
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local user with permissions to load BPF programs can trigger a Denial of Service (DoS) by creating deeply nested or cyclical object references using local kernel pointers. During object cleanup, synchronous recursive processing can exhaust available kernel stack space, resulting in a system crash.
Statement
This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires an attacker to possess elevated local administrative privileges, specifically the capability to load privileged extended Berkeley Packet Filter (eBPF) programs. Systems operating under default configurations restrict unprivileged BPF access, preventing non-administrative users from loading programs with local kernel pointer structures. Consequently, the blast radius is restricted to a local denial of service through kernel stack exhaustion, with no compromise of data confidentiality or integrity.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
