CVE-2026-98058

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. Certain internal helper functions that pause execution to perform blocking operations were not properly marked as sleepable. A local user with permissions to load BPF programs can invoke these functions within non-sleepable timer callbacks. This action triggers an invalid scheduling state, leading to a kernel crash and resulting in a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, affecting Red Hat Enterprise Linux 8, 9, and 10 (including the kernel-rt packages), Red Hat OpenShift 4 and 5 (through RHEL CoreOS 9 based nodes), and RHIVOS 2. The BPF helpers bpf_sys_bpf() and bpf_sys_close(), which are limited to BPF_PROG_TYPE_SYSCALL programs, can sleep because they take mutexes, allocate memory with GFP_KERNEL, and wait for RCU grace periods, but they were not marked as sleepable (.might_sleep) on their prototypes. A local user with the privileges required to load BPF programs can register a bpf_timer callback, which the verifier checks in a non-sleepable context while retaining the syscall helper set, and call these sleepable helpers from hrtimer softirq (atomic) context, triggering a scheduling-while-atomic failure that crashes the kernel and results in a denial of service. Red Hat Enterprise Linux 6 and 7, certain Red Hat Enterprise Linux 8 kernel streams, and OpenShift 4 RHEL CoreOS 8 nodes are not affected because the vulnerable code, introduced upstream in kernel 5.14, is not present in those releases. Red Hat rates this flaw as having low security impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges to load BPF programs and the impact is limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.