CVE-2026-97906

A flaw was found in the Linux kernel. A local attacker with the ability to supply a crafted initial RAM disk (initrd) can trigger an integer overflow during boot configuration parsing. This flaw allows the attacker to bypass memory bounds checks, causing the system to read unmapped memory and crash during early boot, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's boot configuration (bootconfig) handling of the initial RAM disk (initrd). Red Hat Product Security has rated this issue as having LOW security impact. In get_boot_config_from_initrd(), a crafted initrd with an oversized bootconfig size value can cause pointer arithmetic to wrap around, bypassing the initrd bounds check. The kernel then calls xbc_calc_checksum() with an invalid address and an attacker-controlled length, reading unmapped memory and triggering a fatal kernel page fault during early boot, resulting in a denial of service. Exploiting this flaw requires the ability to supply or modify the initrd or another trusted boot artifact, which typically requires root, bootloader, or provisioning-infrastructure control; the issue is not reachable by an unprivileged local user and has no confidentiality or integrity impact. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact as LOW because reliable triggering requires control of trusted boot artifacts. Red Hat Enterprise Linux 9 and 10 (including the kernel and kernel-rt packages), Red Hat In-Vehicle OS 2, and OpenShift Container Platform versions based on RHEL CoreOS 9 are affected; the fix is currently deferred to a future update because of the low risk, and the residual risk is limited to a denial of service at boot by an attacker who already controls the system's boot environment. Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform 4.12 (based on RHEL CoreOS 8) are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.