CVE-2026-89991

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component. When a Non-Maskable Interrupt (NMI) re-enters the pcpu_freelist_push function on a system configured with a single possible CPU, and the interrupted context holds the freelist lock, an infinite loop can occur. This prevents the system from making progress, leading to a Denial of Service (DoS).

Red Hat has evaluated this vulnerability as having a Moderate severity impact because successful exploitation results strictly in a local denial of service under highly specialized system configurations. Standard enterprise environments running Red Hat distributions operate on multi-processor architectures, whereas this hang occurs only when a system is constrained to a single active CPU and processes concurrent BPF programs within interrupt handlers. Consequently, the blast radius is restricted to system unavailability on affected single-core deployments without exposing system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.