CVE-2026-98419

A flaw was found in the Linux kernel's drop_monitor subsystem. An incorrect buffer size calculation during per-CPU data resets leads to an out-of-bounds write when clearing memory. A local user could exploit this vulnerability to corrupt kernel memory, resulting in a system crash and Denial of Service (DoS).

A moderate out-of-bounds write flaw was found in the Linux kernel's drop_monitor subsystem. It affects the kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9 and 10, the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, and the RHEL CoreOS 8 and RHEL CoreOS 9 layers of OpenShift Container Platform 4. When drop monitoring is active and per-CPU statistics are reset, an incorrect buffer size calculation causes memset() to write four bytes past the end of the allocated socket buffer, corrupting the skb_shared_info structure. A local user who can trigger packet drops on a system where drop monitoring is active could exploit this to corrupt kernel memory and crash the system, resulting in a denial of service; the flaw does not compromise confidentiality or integrity. Red Hat Enterprise Linux 6 is out of support scope and will not receive a fix. For the affected products, the fix has been deferred to a future scheduled update because the flaw is rated moderate impact and the residual risk is limited to local denial of service by an authenticated local user with access to a system running active drop monitoring.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.