CVE-2026-98384

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. When processing socket destruction requests through the bpf_sock_destroy() helper, the kernel fails to properly verify if a socket is a full socket before attempting to read its protocol field, causing an out-of-bounds memory read. A local user authorized to execute BPF programs can exploit this vulnerability to cause a system crash, resulting in a Denial of Service (DoS), or potentially disclose sensitive kernel memory.

A moderate-impact flaw was found in the Linux kernel BPF subsystem in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9 kernels shipped with OpenShift Container Platform 4.19 and later. The bpf_sock_destroy() BPF helper reads the sk_protocol field, which exists only in the full struct sock, but the TCP BPF iterator can hand it a timewait or request socket, which is based on the smaller struct sock_common. Reading sk_protocol past the end of such an object causes a two-byte slab out-of-bounds read that can crash the kernel, resulting in a denial of service. Exploitation requires local access with authorization to load and execute BPF programs, and the read value is not returned to user space, so Red Hat rates this flaw as Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 7 and 8, the earlier RHEL 9 streams 9.2 and 9.4, and OpenShift Container Platform 4.18 and earlier are not affected because the vulnerable bpf_sock_destroy kfunc is not present in those kernels. For the affected streams the fix is deferred to a future regularly scheduled kernel update; the residual risk is limited to local denial of service by a user who already holds the privileges required to run BPF programs, with no direct information disclosure or privilege escalation demonstrated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.