CVE-2026-98061

A flaw was found in the Linux kernel's eBPF (Extended Berkeley Packet Filter) verifier. A privileged local user with the CAP_BPF capability can exploit this vulnerability by loading a crafted program that makes a tail call directly from within a callback function. This triggers an inconsistent internal verifier state, producing an unexpected kernel warning that can lead to a denial of service (DoS).

A low impact vulnerability was found in the Linux kernel eBPF (Extended Berkeley Packet Filter) verifier. A local user privileged with the CAP_BPF capability can trigger this issue by loading a crafted BPF program that performs a tail call directly from a callback frame. Because a tail call from a non-zero frame is modeled as a return from that frame, the verifier constructs an inconsistent internal state during precision backtracking, which triggers the "callback unexpected regs" verifier bug and results in a kernel WARN and an -EFAULT failure of the BPF_PROG_LOAD operation. The practical consequence is a denial of service limited to a system crash on systems configured with panic_on_warn; there is no impact on confidentiality or integrity, and tail calls from ordinary subprograms are unaffected. Within Red Hat's product portfolio, this flaw affects Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 kernels, while Red Hat Enterprise Linux 6, 7, 8, and 9, several Red Hat Enterprise Linux 10 update streams, and OpenShift 4 and 5 (RHCOS) are not affected because the vulnerable code is not present in those kernels. Red Hat has rated this flaw as low impact despite the moderate Red Hat CVSS:3.1 score of 5.5, because exploitation requires privileged local access with CAP_BPF and the direct result is only a kernel warning and a failed program load.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.