CVE-2026-98064

A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) and crash the system by running a specially crafted BPF (Berkeley Packet Filter) program. The issue occurs within the BPF Type Format (BTF) component when attempting to display data referencing a void data type, which lacks a defined display handler. Because the kernel fails to verify the existence of this handler before invoking it, a null pointer dereference occurs, leading to a kernel crash.

A NULL pointer dereference flaw in the Linux kernel's BPF Type Format (BTF) display logic has been rated Low impact by Red Hat Product Security. In btf_modifier_show(), the kernel resolves a BTF modifier type and calls its show operation without first verifying that one exists. The void BTF type has no entry in kind_ops[], so a BPF program that passes a type resolving to void (for example a "const void") to the bpf_snprintf_btf() helper triggers a NULL pointer dereference that crashes the kernel. A local attacker able to load and run BPF programs, which requires CAP_BPF or CAP_SYS_ADMIN privileges, could exploit this flaw to cause a denial of service; there is no impact to confidentiality or integrity. Red Hat Enterprise Linux 6 and 7 (including kernel-rt) and the RHEL 8.4 z-stream are not affected because the vulnerable code is not present, while the affected RHEL, Red Hat In-Vehicle OS, and OpenShift RHEL CoreOS kernel streams have the fix deferred. The fix is deferred because exploitation requires elevated local privileges, whose holders already have more direct means to disrupt a system, so the residual risk is limited to a privileged local user causing a kernel crash. For this reason Red Hat assesses the impact as Low even though the CVSS:3.1 base score is 5.5 (Moderate), as practical exploitation depends on privileged BPF program loading.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.