CVE-2026-98045

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. Certain stack retrieval helper functions can perform blocking filesystem operations, but were not properly marked as sleepable. A local user with permission to load BPF programs could exploit this flaw by invoking these helpers within non-sleepable, atomic execution contexts. This context violation can trigger a kernel crash, resulting in a Denial of Service (DoS).

A low impact denial of service flaw was found in the Linux kernel BPF subsystem as shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases that use the RHEL 9 based coreos kernel. The faultable variants of the bpf_get_stack() and bpf_get_task_stack() helpers may block on filesystem reads while resolving user-space build IDs, but their prototypes were not marked as sleepable. Because the BPF verifier selects helper prototypes based on the sleepability of the whole program, these helpers could be invoked from non-sleepable atomic execution contexts within a sleepable program, such as explicit RCU read-side or preemption-disabled regions, or from a non-sleepable timer callback. A local user with the privileges required to load BPF programs could exploit this flaw to trigger sleeping in an atomic context, causing a kernel crash or hang and resulting in denial of service. This flaw was introduced upstream in kernel 6.12, so Red Hat Enterprise Linux 6, 7, and 8, and the RHEL 9.2 and 9.4 update streams, are not affected because the vulnerable code is not present. Red Hat rates the severity of this flaw as low because exploitation requires local access with elevated BPF-related privileges and the impact is limited to system availability, even though the CVSS:3.1 base score is 5.5 (moderate). For the affected products the fix is deferred to a future update; the residual risk is limited to local denial of service by an already-privileged user who is able to load BPF programs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.