CVE-2026-98047

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier, which may allow a local attacker to cause a denial of service (DoS) or potentially escalate privileges. When verifying red-black tree (rbtree) callbacks, the verifier fails to enforce callback restrictions across nested subprogram call frames. A local user capable of loading BPF programs can exploit this issue to bypass safety checks and alter locked tree nodes, resulting in freed memory being linked back into the tree. This behavior causes kernel memory corruption and can lead to a system crash.

This vulnerability is rated as Moderate severity rather than Important because exploitation requires local access, the capability to load custom BPF programs, and intricate nested execution flows to trigger the memory corruption. On standard Red Hat Enterprise Linux systems, unprivileged eBPF is disabled by default, which restricts loading of BPF programs to privileged users holding administrative capabilities like CAP_BPF or CAP_SYS_ADMIN. Consequently, untrusted local accounts cannot trigger the verifier flaw without non-standard configuration changes or existing elevated access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.