CVE-2026-98259
Description
A flaw was found in the Linux kernel. A local user could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system. In the Direct Access (DAX) subsystem, the kernel fails to verify whether storage entries are zero or empty before converting them, leading to an invalid memory access that triggers a kernel panic.
Statement
A low impact flaw was found in the Linux kernel's Direct Access (DAX) subsystem (fs/dax). Before converting an xarray entry with dax_to_folio(), the kernel did not verify whether the entry was zero or empty in dax_associate_entry(), dax_disassociate_entry(), and dax_busy_page(). Passing such an entry results in an invalid memory access that causes a kernel panic. A local user able to trigger page faults on a DAX-enabled filesystem or storage device could use this flaw to crash the system, resulting in a denial of service. Red Hat rated this flaw as LOW impact, with a Red Hat CVSS:3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), because exploitation requires local access and DAX-enabled storage and affects only system availability.
The code that introduced this flaw first appeared in the upstream 6.15 kernel and is not present in Red Hat Enterprise Linux 6, 7, 8, and 9, or in the Red Hat Enterprise Linux CoreOS kernels shipped with OpenShift Container Platform 4 and 5, so those products are not affected. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; fixes for these streams are currently deferred, and the residual risk is that a local user could panic (crash) a system using DAX-enabled storage, causing a denial of service.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
