CVE-2026-97420

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF program modifies a system control (sysctl) parameter, the kernel fails to append a null-terminating byte to the replacement buffer. Downstream kernel parsers expecting a properly terminated string may read past the buffer boundary, resulting in an out-of-bounds memory access. A local user could exploit this flaw to cause a Denial of Service (DoS) through a system crash or potentially access sensitive kernel memory.

A moderate-impact flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem in kernel/bpf/cgroup.c, affecting Red Hat Enterprise Linux kernel packages (kernel, kernel-rt) and other affected Red Hat kernel-based offerings recorded on this flaw. When a cgroup sysctl BPF program calls the bpf_sysctl_set_new_value() helper to replace a pending sysctl value, the helper copies only the replacement buffer length without appending a terminating NUL byte. Sysctl proc handlers and their downstream string parsers expect a NUL-terminated buffer and may read past the end of the allocated page or slab, resulting in an out-of-bounds read (observed as a KASAN slab-out-of-bounds read in strnchrnul via bitmap_parse and flow_limit_cpu_sysctl). A local user with the privileges required to write to sysctl entries and load and attach cgroup sysctl BPF programs could exploit this flaw to crash the kernel, causing a denial of service; in the worst case an out-of-bounds read could expose kernel memory, although no information disclosure or write primitive is demonstrated. The flaw is rated Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local, privileged access and the primary consequence is loss of availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.