CVE-2026-98613

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local user with permissions to load BPF programs can trigger a Denial of Service (DoS) by creating deeply nested or cyclical object references using local kernel pointers. During object cleanup, synchronous recursive processing can exhaust available kernel stack space, resulting in a system crash.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires an attacker to possess elevated local administrative privileges, specifically the capability to load privileged extended Berkeley Packet Filter (eBPF) programs. Systems operating under default configurations restrict unprivileged BPF access, preventing non-administrative users from loading programs with local kernel pointer structures. Consequently, the blast radius is restricted to a local denial of service through kernel stack exhaustion, with no compromise of data confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.