CVE-2026-98134

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. During pointer register comparisons, the verifier can incorrectly deduce that a pointer cannot be null when it can actually be null at runtime. A local user with permissions to load BPF programs could exploit this flaw by submitting a crafted program, causing an unverified null pointer dereference that leads to a kernel crash and Denial of Service (DoS).

A low-impact flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier, which is shipped in the kernel of Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases based on the RHEL 9 kernel. When verifying conditional jump instructions that compare two pointer registers, check_cond_jmp_op() can incorrectly infer that a pointer is non-null: the absence of the PTR_MAYBE_NULL flag on one operand's type is treated as proof that the value cannot be NULL at runtime, even though types such as PTR_TO_MEM may legitimately hold NULL. A local user with permission to load BPF programs (in practice CAP_BPF or CAP_SYS_ADMIN capabilities) could submit a crafted BPF program that passes verification and then performs an unverified NULL pointer dereference, crashing the kernel and causing a denial of service. There is no impact on confidentiality or integrity. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact of this flaw as Low because exploitation requires privileged local access to load BPF programs. Older Red Hat Enterprise Linux streams (RHEL 6, 7, and 8, and RHEL 9.2 and earlier z-streams, including their kernel-rt variants) and OpenShift Container Platform 4.12 through 4.15 do not contain the code that introduced this flaw and are therefore not affected. For the affected streams, the fix is currently deferred because the flaw is a low-impact local denial of service that requires BPF program loading privileges; the residual risk of the deferral is a kernel crash (denial of service) triggered by an already-privileged local user, with no confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.