CVE-2026-98041

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. The verifier incorrectly predicts that 32-bit conditional branch comparisons between a pointer and zero are always taken, failing to account for valid pointer values whose lower 32 bits can be zero. A local attacker could exploit this vulnerability by loading a specially crafted BPF program to bypass safety checks, potentially resulting in out-of-bounds kernel memory access and local privilege escalation.

This vulnerability is rated as Moderate impact because exploitation requires local system access and the ability to load extended BPF programs, which is restricted to privileged users by default on Red Hat Enterprise Linux. Although an inaccurate branch prediction during verification allows crafted programs to bypass safety constraints and access arbitrary kernel memory, standard configurations do not expose the eBPF subsystem to unprivileged local accounts. Consequently, an attacker cannot exploit this flaw to escalate privileges without already possessing elevated capabilities such as CAP_BPF or CAP_SYS_ADMIN.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.