CVE-2026-90157

A flaw was found in the Linux kernel. A local attacker could exploit a vulnerability in the BPF (Berkeley Packet Filter) cgroup getsockopt hook. By providing a negative length value, a malicious BPF program could cause the kernel's memory copy function to process an invalid size. This could lead to a system crash, resulting in a denial of service.

A moderate severity denial of service flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) cgroup getsockopt hook. A cgroup getsockopt BPF program can set a negative ctx->optlen after the kernel getsockopt handler has run; the kernel-buffer variant of this hook, used by TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original length, so a negative optlen is accepted and propagated back to the TCP getsockopt code. The negative value can then be passed to copy_to_sockptr() as a size_t and trigger the hardened usercopy bytes > INT_MAX check, resulting in a system crash. Exploitation requires local access with the privileges needed to load and attach a malicious cgroup getsockopt BPF program, and a successful attack affects system availability only. This issue affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and the RHEL CoreOS kernels shipped with OpenShift 4. Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and the Red Hat Enterprise Linux 8.4 z-stream are not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are currently deferred: since exploitation requires an already-privileged local user and the consequence is limited to loss of availability, the residual risk of deferral is low and consists of a potential local system crash (denial of service).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.