CVE-2026-31525

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) interpreter. The interpreter's signed 32-bit division and modulo operations exhibit undefined behavior when processing the minimum 32-bit signed integer value (S32_MIN) due to an incorrect use of the abs() macro. This inconsistency between the interpreter's execution and the verifier's expected behavior can be leveraged by a local attacker. Successful exploitation could lead to out-of-bounds memory access within BPF maps, potentially resulting in information disclosure or privilege escalation.

A moderate severity flaw was found in the Linux kernel BPF interpreter affecting Red Hat Enterprise Linux 9 (from the 9.4 update stream onward), Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS. The interpreter's handlers for the signed 32-bit BPF division and modulo instructions use the kernel's abs() macro on s32 operands; this macro's result is undefined when the input is the minimum 32-bit signed value (S32_MIN). In that case the interpreter computes an incorrect result that differs from the mathematically correct result the verifier uses for register range tracking. A local attacker able to load and run a crafted BPF program could exploit this verifier/interpreter mismatch to perform out-of-bounds access to BPF map values, potentially resulting in information disclosure or privilege escalation. Red Hat Enterprise Linux 6, 7, and 8, and the RHEL 9.0 and 9.2 update streams are not affected because the vulnerable code is not present in those kernels. For the affected RHEL 9 and RHEL 10 kernel and kernel-rt streams the fix is deferred to a future update; the residual risk is limited to local attackers with the ability to load malicious BPF programs, and Red Hat's CVSS assessment reflects the high attack complexity and privileges required for exploitation. In Red Hat In-Vehicle OS 2.0, the main stream is deferred while a fix is being pursued through the delegated core stream. Red Hat rates this flaw Moderate (CVSS:3.1 6.4, AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), lower than the upstream Important rating (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), because successful exploitation is judged to require higher privileges and greater attack complexity than the upstream scoring assumes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.