CVE-2026-98117

A flaw was found in the Linux kernel's cachefiles subsystem. When processing cache coherency trace events, the system reads fixed-size data from a buffer that may be empty or shorter than expected. A local user could exploit this flaw to trigger an out-of-bounds memory read, resulting in a system crash and denial of service (DoS) or potential information disclosure.

A flaw of moderate security impact was found in the Linux kernel cachefiles subsystem shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The cachefiles coherency tracepoint reads a fixed 8-byte value from the variable-length auxiliary data in struct cachefiles_xattr without ensuring the buffer is at least 8 bytes long; the data can be shorter or even empty, resulting in an out-of-bounds read that can produce a KASAN warning or a use-after-free report and, on systems configured to panic on warnings, a kernel crash and local denial of service. Red Hat Enterprise Linux 10 (kernel in rhel-10.2.z, rhel-10.3, and rhel-10.4) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm in rhivos-2.0.z, rhivos-2.0.z-core, rhivos-2.1, and rhivos-2.1-core) are affected because the cachefiles auxiliary data tracing code that introduced the flaw is present in those streams. Earlier Red Hat Enterprise Linux versions (including RHEL 6, 7, 8, 9, and rhel-10.0.z) and OpenShift Container Platform releases are not affected because the vulnerable code is not present there. For the affected streams the fix is currently deferred to a future update; the residual risk is limited to local denial of service, since triggering the flaw requires a local user able to perform cache coherency operations on a cachefiles-backed filesystem with the coherency tracepoint active (Red Hat CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.