CVE-2026-98044

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier. This issue allows a privileged local user to cause a Denial of Service (DoS) or unexpected program rejection by loading a specially crafted BPF program containing legacy packet-load instructions inside callback functions. Due to an internal logic error during register state analysis on simulated return paths, the verifier fails validation and triggers a kernel warning.

A LOW severity denial-of-service flaw was found in the Linux kernel BPF (Berkeley Packet Filter) verifier, affecting Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS. A privileged local user who is able to load BPF programs (requiring privileges such as CAP_BPF or CAP_SYS_ADMIN) can load a specially crafted BPF program that uses deprecated legacy packet-load instructions (BPF_LD_ABS or BPF_LD_IND) inside callback functions. Due to an internal logic error in the verifier's register-state analysis on the synthesized failure-return path, precision backtracking triggers the "callback unexpected regs" verifier warning and the BPF_PROG_LOAD operation fails with -EFAULT. The direct consequence is a kernel warning and rejection of the crafted program load; on systems configured to panic on kernel warnings this can result in a system crash. Confidentiality and integrity are not impacted.

Red Hat Enterprise Linux 6, 7, 8, and 9, the RHEL 10.0 and 10.2 streams, and OpenShift Container Platform 4.12 through 4.23 and 5.x are not affected because the vulnerable code is not present in those products. For the affected streams, the fix is deferred: exploitation requires an already-privileged local user and results only in a verifier warning, a failed program load, or warning-induced denial of service, so the fix will be addressed in a future update rather than immediately. The residual risk is limited to local denial of service by a privileged user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.