CVE-2026-98402

A flaw was found in the Linux kernel. An attacker could cause a Denial of Service (DoS) or system instability by triggering network error events while kernel event tracing is active. When recording Internet Control Message Protocol (ICMP) messages, the kernel attempts to read transport header information without verifying that the packet header is initialized and valid, leading to an invalid memory read that can crash the system.

A low impact flaw was found in the Linux kernel's ICMP event tracing. When the icmp:icmp_send tracepoint is active, an attacker who can trigger network error paths that reach __icmp_send() (for example link failures, ARP errors, forwarding, or AF_PACKET) can cause the tracepoint to read UDP transport header information without first verifying that the packet is UDP and that its transport header was initialized, resulting in an invalid memory read. The demonstrated impact is a kernel WARNING under CONFIG_DEBUG_NET=y, which can escalate to a system crash and denial of service on systems configured to panic on warnings; only availability is affected. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected, with fixes currently deferred because the vulnerable path requires the non-default icmp:icmp_send tracepoint to be enabled and the assessed impact is low, leaving residual risk only for systems running such event tracing. RHEL 7, 8, and 9 (including kernel-rt) and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present in those kernels; RHEL 6 ELS is out of support scope. Red Hat assessed this flaw as Low impact despite the CVSS:3.1 score of 5.5 (Moderate), because reliable exploitation requires the non-default diagnostic configuration of active ICMP event tracing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code is only executed when the icmp:icmp_send kernel tracepoint is enabled, which is not a default configuration. On affected kernels, disabling the icmp:icmp_send tracepoint (or not enabling ICMP event tracing) prevents the invalid transport header access. Where event tracing must remain enabled, ensuring the kernel does not panic on warnings (for example by booting or setting panic_on_warn=0) limits the demonstrated impact to a kernel warning rather than a system crash.