CVE-2026-90247

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component. This vulnerability allows for a memory map (mmap) lock to be leaked when handling interrupt work, specifically within the stack_map_get_build_id_offset() and bpf_find_vma() functions. This can lead to a situation where two read locks are acquired but only one is released, ultimately blocking the system's ability to exit memory map operations. The most significant consequence of this flaw is a denial of service (DoS), which can prevent legitimate users from accessing system resources.

A moderate severity denial of service flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem, affecting the kernel packages shipped in Red Hat Enterprise Linux 8, 9, and 10 (including the kernel-rt variants), Red Hat In-Vehicle OS 2, and the Red Hat CoreOS container images used by OpenShift Container Platform 4. In the irq_work path that defers mmap_read_unlock() out of NMI context, stack_map_get_build_id_offset() and bpf_find_vma() reuse the same per-CPU mmap_unlock_work slot and only check whether that work is busy before taking the mmap read lock. A nested caller can therefore reuse the slot before the first caller queues it, resulting in two read locks being acquired while only one deferred unlock runs. The leaked read lock blocks exit_mmap(), so a local user with low privileges able to reach these BPF code paths can hang the affected system, causing a denial of service. Red Hat scored this flaw CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local attack vector with availability-only impact. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels. The fix is deferred for the affected streams and is planned to be delivered in a future kernel update; the residual risk is limited to local denial of service, with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.