CVE-2026-97944

A flaw was found in the Linux kernel. An incorrect offset calculation in the FineIBT Control Flow Integrity (CFI) mechanism causes invalid hash values to be read for Berkeley Packet Filter (BPF) trampolines. Consequently, indirect function calls into these BPF programs fail integrity verification and crash the system. A local user capable of triggering affected BPF operations can exploit this issue to cause a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel FineIBT Control Flow Integrity (CFI) implementation. An open-coded offset in cfi_get_func_hash() reads the FineIBT hash from offset 7 of the function preamble even though the hash immediate now starts at offset 5. The BPF JIT uses this value to provide a struct_ops trampoline with the CFI hash of the stub function it stands in for, so the trampoline is assigned a corrupted hash. The first indirect call from the kernel into the BPF struct_ops program, for example tcp_init_congestion_control() invoking the ->init() operation of a BPF congestion control algorithm, then fails the FineIBT check and terminates the kernel with a fatal CFI failure, resulting in a local denial of service. Exploitation requires local access and the privileges needed to load and attach BPF struct_ops programs (for example CAP_BPF, CAP_SYS_ADMIN, or CAP_NET_ADMIN), and only configurations where FineIBT is enabled are affected. Red Hat Enterprise Linux 7, 8, 9, and 10 are marked not affected because the vulnerable code is not present in the shipped kernels. Red Hat Enterprise Linux 6 Extended Lifecycle Support is recorded as out of support scope for this issue. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact of this flaw as low because it requires local privileged access and only causes a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.