CVE-2026-92486

A flaw was found in the Linux kernel, specifically within its Berkeley Packet Filter (BPF) subprograms. This vulnerability arises from a mismatch in how BPF subprograms handle certain internal functions, known as callbacks. When a task attempts to execute a callback, it uses an incorrect method, which can bypass the kernel's Control-Flow Integrity (kCFI) protections. This bypass could potentially allow an attacker to interfere with the normal operation of the kernel.

This vulnerability is rated as having a Low severity impact because exploitation requires local access with elevated privileges to load and trigger eBPF programs, and the failure mode is restricted to a kernel crash under systems enforcing fine-grained control-flow integrity. In typical Red Hat deployments, unprivileged users cannot interact with the affected subsystem routines. Consequently, the flaw cannot be leveraged remotely or by unprivileged attackers to achieve privilege escalation or data leakage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.