CVE-2026-98869

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. A local attacker could achieve privilege escalation by loading a specially crafted BPF program into the kernel. The vulnerability occurs because the verifier fails to properly track register states across execution paths during 32-bit operations, leading to missing zero-extension instructions. Consequently, an attacker can inject arbitrary values into 64-bit registers to bypass kernel safety checks and compromise system memory.

This vulnerability is rated as Important severity because an attacker capable of loading BPF programs can bypass verifier bounds checks to corrupt kernel memory and potentially elevate privileges. In standard Red Hat Enterprise Linux environments, unprivileged eBPF execution is disabled by default, substantially limiting exposure to accounts possessing CAP_BPF or CAP_SYS_ADMIN privileges. Therefore, exploitation by untrusted local users is constrained unless administrative access has already been obtained or unprivileged BPF is explicitly permitted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.