CVE-2026-90159

A flaw was found in the Linux kernel. Specifically, a concurrency vulnerability exists within the Berkeley Packet Filter (BPF) subsystem when handling cgroup UNIX getname hooks. This issue arises because certain BPF functions, bpf_setsockopt() and bpf_getsockopt(), are called without first acquiring a required socket lock. A local attacker could potentially trigger a system warning and cause instability or a denial of service by executing a specially crafted BPF program.

A moderate-impact flaw was found in the Linux kernel as shipped in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. The BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME cgroup hooks run attached BPF programs without acquiring the socket lock, while the bpf_setsockopt() and bpf_getsockopt() helpers require that lock to be held. A local attacker with the ability to load and attach a specially crafted BPF program to one of these hooks could trigger the sock_owned_by_me() lock-assertion warning, causing kernel instability and a potential denial of service; confidentiality and integrity are not impacted. Red Hat Enterprise Linux 7, 8, and 9 (including the Real Time kernels) and the RHCOS 8 and RHCOS 9 kernels used by OpenShift Container Platform 4 and 5 are not affected because the vulnerable code is not present in those kernels, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of active support scope. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams, the fix is deferred to a future maintenance update because the flaw manifests as a kernel lock-assertion warning rather than memory corruption or privilege escalation, making it a lower-priority fix. The residual risk is limited: exploitation requires local access with sufficient privileges to attach BPF programs to the affected cgroup hooks, and the impact is restricted to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.