CVE-2026-98038

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. When validating programs that manage shared reference-counted objects, the BPF verifier incorrectly treats borrowed references as always valid and fails to require null-pointer checks. A local user can exploit this vulnerability by loading a crafted BPF program, triggering a null-pointer dereference that causes a kernel crash and Denial of Service (DoS).

A low-impact flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem verifier. When validating BPF programs that operate on refcounted kptrs, the verifier incorrectly treats a borrowed RCU-protected kptr passed to bpf_refcount_acquire() as an owning reference and therefore does not require a NULL check on the helper's return value. If the program drops the last real reference to the object while still inside an RCU critical section, refcount_inc_not_zero() returns NULL and the program can then dereference that NULL pointer, causing a kernel crash and local denial of service. Exploitation requires local access with the ability to load a crafted BPF program, and only availability is affected; there is no confidentiality or integrity impact. While the CVSS:3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), Red Hat rates the overall impact of this flaw as low because exploitation requires local privileges and the consequence is limited to denial of service. Affected Red Hat products include Red Hat Enterprise Linux 9 and 10 (kernel), Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm), and OpenShift Container Platform releases shipping RHEL 9 CoreOS (4.19 and later, including 5.x). Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 and 9.4 z-streams, and OpenShift Container Platform 4.12 through 4.18 are not affected because the vulnerable code is not present in those releases. The fix for the affected streams is currently deferred given the low impact and the local, denial-of-service-only nature of the flaw; the residual risk is that a local user with the ability to load BPF programs could crash the kernel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.