CVE-2026-98048

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier. This vulnerability may allow a local user to achieve privilege escalation or cause a Denial of Service (DoS) through memory corruption. During helper call optimizations, the verifier improperly rewrites instruction sequences that are entered by a jump instruction. A local attacker with permission to load BPF programs can exploit this issue by submitting a specially crafted program, triggering unsound instruction transformations that bypass safety checks.

An unsound BPF fastcall optimization can rewrite a verified spill, call, and fill instruction pattern even when a jump enters the middle of that pattern. Removing the spill and fill instructions can change the runtime register state while later instructions remain validated against the original program state. This verifier to runtime semantic mismatch may allow a crafted BPF program to use a scalar or another unexpected value where the verifier expects a safe register value or pointer. Impact is at least a local denial of service and may include kernel memory corruption, privilege escalation, and loss of confidentiality and integrity. For the CVSS the PR:L value is used because a local process must be able to load a crafted BPF program, typically through CAP_BPF, CAP_SYS_ADMIN, delegated BPF access, or enabled unprivileged BPF. The issue is not network reachable. The paranoid score uses CIA:HHH because a post verification semantic mismatch can plausibly undermine BPF memory safety, although a concrete arbitrary read or write primitive is not demonstrated by the supplied diff.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.