This vulnerability affects the readelf utility in the binutils package on Red Hat Enterprise Linux 10. A local attacker can supply a malicious ELF file that triggers either a resource exhaustion condition (CWE-400) or a null pointer dereference (CWE-476). The resource exhaustion can cause the system to run out of memory, while the null pointer dereference causes a segmentation fault. Both conditions result in denial of service by making the readelf utility unresponsive or crashing it. The CVSS 3.1 base score is 5.5, reflecting medium severity with local attack vector, low complexity, no privileges required, user interaction needed, and impact limited to availability.

Successful exploitation results in denial of service by crashing or hanging the readelf utility, potentially affecting system availability for users relying on this tool. There is no impact on confidentiality or integrity. The attack requires local access and user interaction to trigger the vulnerability.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-6844 for current remediation guidance. Until an official fix is available, limit local user access to the readelf utility and avoid processing untrusted ELF files with readelf to reduce risk.