CVE-2026-98075

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF program references its main function as a callback, the kernel fails to translate the function reference into a valid memory address. A local user with permissions to load BPF programs could exploit this vulnerability by invoking the unresolved reference, causing a kernel crash and a Denial of Service (DoS).

The BPF verifier can accept a BPF_PSEUDO_FUNC reference to the main program even though this reference is not rewritten to a real function address when no additional subprogram exists. A program can pass the resulting bogus function pointer to bpf_timer_set_callback or a similar callback interface and cause the kernel to perform an indirect call through an invalid address. The directly supported impact is a local kernel crash and denial of service. The invalid indirect call also creates a potential control flow primitive that may have greater confidentiality and integrity impact if the target address can be influenced reliably. For the CVSS the PR:L value is used because a local process must load the crafted BPF program and must have the BPF access granted by the system policy. The issue is not network reachable. The paranoid assessment uses AC:H and CIA:HHH because privilege escalation would require additional control over the unresolved address and kernel execution layout.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.