CVE-2026-98591

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. An integer underflow in the bounds-checking logic for network packet buffer pointers allows validation checks to pass incorrectly. A local user capable of running BPF programs could exploit this flaw to create pointers referencing invalid memory, potentially leading to out-of-bounds memory access, a denial of service (system crash), or privilege escalation.

This vulnerability is rated Moderate because successful exploitation requires high local privileges, such as CAP_BPF or CAP_NET_ADMIN, to attach and execute extended BPF programs. In Red Hat Enterprise Linux, unprivileged access to BPF is restricted by default, preventing standard local accounts from interacting with the affected subsystem. Additionally, the skb-backed dynptr feature is not present in enterprise releases such as RHEL 8 and 9, limiting potential exposure to newer platforms where administrative privileges are already compromised.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.