CVE-2026-98278

A flaw was found in the Linux kernel. A local privileged user with network administration capabilities can configure a routing loop on an IP tunnel interface. When offloading network traffic through the misconfigured tunnel, the system triggers an unexpected kernel warning, potentially leading to a Denial of Service (DoS) if the kernel is configured to halt on warnings.

This is a low-impact flaw in the Linux kernel's netfilter flowtable offload path. A local user with network administration privileges (CAP_NET_ADMIN) can configure a routing loop in which the route to an IP tunnel's remote endpoint resolves back to the tunnel device itself. When a flowtable then tries to offload a flow through such a tunnel, dev_fill_forward_path() makes no progress and trips a WARN_ON_ONCE() warning instead of gracefully failing the walk. Under default Red Hat configurations the consequence is only a kernel warning and a failed flow offload; on systems configured to halt on warnings (for example with panic_on_warn) this can be turned into a local denial of service.

The vulnerable code, introduced by the flowtable IPIP receive software acceleration feature, is present only in Red Hat Enterprise Linux 10.3 and 10.4 and in the Red Hat In-Vehicle OS 2.0 and 2.1 kernel streams; earlier RHEL 6 through 9 streams, the other RHEL 10 minor streams, and the OpenShift RHEL CoreOS images do not contain the vulnerable code and are therefore not affected. For the affected streams the fix is deferred to a future planned update; the residual risk remains low because triggering the flaw requires CAP_NET_ADMIN privileges to deliberately create the misconfigured tunnel routing loop, the tunnel transmit paths already treat such loops as a transmission error, and default configurations only log a warning rather than crashing. Although the Red Hat CVSS:3.1 score of 5.5 (Moderate) reflects the worst-case availability impact on systems that panic on warnings, Red Hat assesses the overall impact as LOW because exploitation requires privileged local access plus a deliberate network misconfiguration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.