CVE-2026-98062

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The kernel incorrectly treats certain signal tracepoint arguments as trusted memory pointers, even when special non-pointer indicator values are passed during signal delivery. A local user with privileges to attach BPF programs can exploit this issue to dereference invalid memory addresses, causing a kernel crash and resulting in a Denial of Service (DoS).

A low impact denial-of-service flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The signal_generate and signal_deliver tracepoints declare their siginfo argument as a struct kernel_siginfo pointer, so BTF context access treats it as a trusted pointer for tp_btf programs. Signal delivery can instead pass the special non-pointer values SEND_SIG_NOINFO (zero) or SEND_SIG_PRIV (one) in this argument. A local user with the privileges required to load and attach BPF tracing programs can dereference these values, causing an invalid kernel memory access and a kernel crash; because signal_generate can run from timer interrupt context, the resulting fault can escalate to a kernel panic. The issue affects availability only, with no impact on confidentiality or integrity.

Red Hat Product Security rates this flaw Low impact because exploitation requires local access together with BPF tracing privileges, which are not granted to untrusted or unprivileged users on typical systems. This differs from the CVSS:3.1 base score of 5.5 (Moderate, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) assigned by both Red Hat and NIST, which assumes only low privileges are required to attach a BPF program.

Currently affected are the kernel in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9, rhel-9.10) and Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, rhel-10.4), Red Hat In-Vehicle OS 2 streams (rhivos-2.0.z, rhivos-2.0.z-core, rhivos-2.1, rhivos-2.1-core), and the kernel in OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1. Red Hat Enterprise Linux 6, 7, and 8, earlier RHEL 9 and RHEL 10 update streams, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present in those kernels. For the affected products the fix is deferred to a future scheduled kernel update given the Low impact rating; the residual risk is that a local user who already holds the privileges to attach BPF tracing programs can crash the kernel, causing denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.