CVE-2026-98588

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. When allocating a socket map with an excessively large entry count, a signed integer overflow occurs during cleanup when the map is released. A local user with permission to create BPF maps can trigger this issue to cause an out-of-bounds memory write, leading to kernel memory corruption or a Denial of Service (DoS) through a system crash.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires elevated administrative privileges to create BPF maps, as well as an extraordinarily large host memory allocation to trigger the condition. By default, unprivileged access to the eBPF subsystem is restricted on Red Hat platforms, preventing standard local users from instantiating socket maps. Even in environments where an attacker holds the necessary capabilities, inducing the bug requires exhausting tens of gigabytes of kernel memory to initiate the malformed cleanup, limiting the impact to kernel corruption or a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.