CVE-2026-98590

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. An error in context code generation incorrectly sign-extends register values when reading socket queue mappings, causing runtime register values to exceed boundaries tracked by the kernel's safety verifier. A local user with permission to load BPF programs can exploit this vulnerability to bypass kernel verifier checks, potentially leading to out-of-bounds memory access, system crash, or local privilege escalation.

The bpf_sock context access generator can place the special rx_queue_mapping value into a 64 bit register while the verifier assumes that the upper 32 bits are zero. A crafted BPF program can shift or otherwise transform this value and obtain a runtime result outside the range accepted by the verifier. This creates a verifier and runtime mismatch that may permit bounds reasoning to be bypassed and can potentially lead to kernel memory access, a kernel crash, or local privilege escalation. For the CVSS the PR:L value is used for the paranoid score because the issue may be reachable by an unprivileged BPF user on systems that enable such loading, or by a restricted container or service account with delegated BPF capabilities. The issue is not directly network reachable and requires local execution of a suitable BPF program. Impact is at least a local security boundary violation and denial of service, with possible high confidentiality and integrity impact if the verifier mismatch can be converted into controlled kernel memory access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.