CVE-2026-98611

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The bpf_crypto_ctx_create() function attempts to read reserved fields from a parameter structure prior to verifying that the supplied buffer is sufficiently large. A local user capable of loading BPF programs can exploit this issue by supplying an undersized buffer, causing an out-of-bounds read from kernel memory. This flaw could lead to the exposure of sensitive kernel information or trigger a system crash resulting in a Denial of Service (DoS).

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because exploitation requires elevated administrative privileges (such as CAP_BPF or CAP_SYS_ADMIN) to load and execute custom BPF programs invoking cryptographic functions. An attacker already possessing these capabilities can trigger an out-of-bounds read, potentially leading to a kernel crash (denial of service) or unintended exposure of kernel memory. Additionally, the vulnerable BPF crypto functionality is not present in older enterprise releases such as RHEL 8 and 9.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.