CVE-2026-98398

A flaw was found in the Linux kernel's lock dependency validator (lockdep). When a lock class is removed, such as during kernel module unloading, cached references in existing lock structures are not properly cleared. A local user can exploit this issue by triggering lock acquisitions that reuse these stale references, resulting in an inconsistent tracking state. This flaw can lead to kernel warnings, disabled lock validation, and potentially a Denial of Service (DoS) via a system crash.

A LOW impact flaw was found in the Linux kernel's lock dependency validator (lockdep), affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, the kernel packages in Red Hat In-Vehicle OS, and the RHEL CoreOS kernels used by OpenShift Container Platform 4. When a lock class is removed, for example during kernel module unload or lock key unregistration, cached class pointers (class_cache entries) stored in existing lockdep_map structures are not invalidated. A local user can trigger lock acquisitions that reuse these stale references, resulting in an invalid class index and an inconsistent lock tracking state. This leads to lockdep DEBUG_LOCKS_WARN_ON kernel warnings, can disable lock validation, and can potentially cause a denial of service through a system crash on systems configured to panic on warnings. Confidentiality and integrity are not affected: the demonstrated effect is stale lockdep diagnostic metadata rather than a memory corruption or arbitrary write primitive, which is why Red Hat rates the impact of this flaw as LOW even though the CVSS 3.1 base score of 5.5 reflects a high availability impact. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels. Because this issue is confined to the lockdep debugging infrastructure, does not provide a memory corruption or privilege escalation primitive, and the stale state arises from operations such as module unloading or lock key unregistration, the fix is currently deferred for the affected products. The residual risk of deferring the fix is limited to lockdep warnings, disabled lock validation, and a possible kernel crash (denial of service), particularly on systems configured with panic_on_warn.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.