CVE-2026-74286

A flaw was found in the Linux kernel's Packet Forwarding Control Protocol (PFCP) module. The module fails to properly allocate per-CPU statistics, leaving a pointer uninitialized. A local attacker can exploit this by creating a PFCP rtnetlink device, which triggers a null pointer dereference. This can lead to a system crash, resulting in a denial of service.

Red Hat rates this vulnerability as Moderate severity because exploitation requires local system privileges to instantiate a network device, confining the potential impact to a local denial of service without compromising system integrity or confidentiality. Under default configurations across Red Hat Enterprise Linux releases, the relevant protocol driver is not actively engaged unless specialized mobile core networking features are configured. Furthermore, supported Red Hat Enterprise Linux kernels do not ship the introduced upstream changes, rendering standard distributions unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.