CVE-2026-98007

A flaw was found in the Linux kernel. A privileged local user can cause a Denial of Service (DoS) by loading a specially crafted BPF (Berkeley Packet Filter) program that passes a pointer value instead of a scalar number as the loop iteration count to the bpf_loop function. Because the kernel's BPF verifier does not strictly enforce scalar arguments for this parameter, an internal tracking failure triggers a kernel warning. On systems configured to panic on warnings, this condition leads to an immediate kernel crash.

A low impact denial of service flaw was found in the Linux kernel BPF subsystem, affecting the kernel packages in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.19 and later releases that ship the RHEL CoreOS 9 kernel. The bpf_loop() helper accepted any value for its nr_loops argument, so a privileged local user with the ability to load BPF programs could pass a pointer where a scalar iteration count was expected. Because BPF verifier precision backtracking only supports scalar registers, this triggers an internal verifier warning; on systems configured with panic_on_warn, the warning causes an immediate kernel panic and denial of service. Only availability is impacted, and exploitation requires high local privileges to load a crafted BPF program, so this flaw is rated low impact.

Older streams, including Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 and 9.4 update streams, the corresponding kernel-rt builds, and OpenShift versions based on RHEL CoreOS 8, are not affected because the vulnerable code is not present in those kernels; the flaw was introduced by the upstream change that began tracking the maximum number of bpf_loop callback iterations.

For the affected streams the fix is deferred to a future update because of the low impact of this flaw and the high privileges required for exploitation. The residual risk is a local denial of service limited to systems where a privileged user can load BPF programs and panic_on_warn is enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw causes a kernel crash only on systems configured to panic on warnings. As a workaround, disable panic_on_warn to prevent the BPF verifier warning from escalating to a kernel panic, for example with 'sysctl -w kernel.panic_on_warn=0' or by adding 'kernel.panic_on_warn=0' to the kernel command line. The underlying verifier warning will still be emitted, and no other mitigation meeting Red Hat Product Security criteria is currently available; a permanent fix is deferred to a future kernel update.