CVE-2026-93148

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component. This vulnerability arises from incorrect boundary checks during BPF Type Format (BTF) struct walks for memory-allocated objects. Specifically, the system fails to reject accesses that extend beyond the allocated object's static size before applying flexible-array relaxations. This out-of-bounds access could potentially lead to memory corruption.

A BPF verifier bounds bug can allow MEM_ALLOC BTF typed objects to be accessed past their statically allocated object size when flexible array walking is incorrectly applied. A local attacker who can load a suitable BPF program may be able to create an out of bounds access through BTF struct walking, kfunc type checks, or kptr type checks. For the CVSS the PR:L is used in the paranoid score because some systems delegate BPF loading to low privileged local users or service accounts, even though many default deployments restrict these helpers to administrative capabilities. The issue is not network reachable and requires local code execution through the BPF loading path. Impact is at least local denial of service via kernel memory corruption and in worst case may allow confidentiality or integrity impact and privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.