CVE-2026-98033

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The kernel's program verifier improperly resets tracking identifiers when preparing callback functions, causing it to confuse different internal data structures sharing the same template. A local user with permission to load BPF programs could exploit this flaw to cause the kernel to access memory after it has been freed. This use-after-free condition can result in privilege escalation or a Denial of Service (DoS) by crashing the system.

A use-after-free in BPF callback verification can occur because callback frame construction restores map_ptr but loses map_uid which distinguishes inner maps sharing the same template. A local process can use callbacks involving bpf_for_each_map_elem and BPF timers to make a timer retain a pointer to a different inner map without a reference. Releasing that map can leave a dangling pointer which is later dereferenced by a timer callback in kernel context. For the CVSS the PR:L is selected because an attacker needs local code execution and the ability to load a suitable BPF program. The issue is not directly network reachable. Impact is at least local denial of service through a kernel use-after-free. The paranoid assessment allows confidentiality and integrity impact because the patch describes a stale kernel map pointer dereferenced after free. Reliable exploitation is complex and depends on BPF permissions and the affected map and timer features.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.