CVE-2026-98043

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. The verifier incorrectly assumes that certain pointer types are non-null without accounting for unbounded offsets that can wrap around to zero at runtime. A local user with permissions to load BPF programs can exploit this flaw by submitting a crafted program, triggering a null pointer dereference that crashes the system and results in a Denial of Service (DoS).

A moderate severity flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. The reg_not_null() helper decided that a register held a non-NULL value based on its pointer type alone, without considering that pointer arithmetic with an unbounded offset can wrap the value to zero at runtime. A local user with permission to load BPF programs could exploit this flaw by submitting a crafted BPF program that passes verifier checks and then dereferences a NULL map value pointer, triggering a NULL pointer dereference that crashes the kernel and results in a denial of service. Red Hat rates this flaw as Moderate (CVSS 3.1 score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and the ability to load BPF programs, and the impact is limited to system availability. The vulnerable code is present in the kernel and kernel-rt packages of Red Hat Enterprise Linux 8, 9, and 10, in Red Hat In-Vehicle OS, and in the RHEL CoreOS kernel shipped with OpenShift Container Platform 4 and 5; fixes for these products are deferred to a later update cycle, so the residual risk remains a local denial of service by a user who already holds the privileges required to load BPF programs. Red Hat Enterprise Linux 6 and 7 (including kernel-rt) are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

On systems where unprivileged users are able to load BPF programs, exposure to this flaw can be reduced by restricting BPF program loading to privileged users, for example by setting the sysctl kernel.unprivileged_bpf_disabled=1. Note that this does not prevent exploitation by a local user who already holds the privileges required to load BPF programs; such a user could still trigger the kernel crash. Mitigation for this issue is otherwise either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.