CVE-2026-98059

Awaiting Analysis Awaiting Analysis - Queue

BPF Null Pointer Dereference in sched_process_wait

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark sched_process_wait argument as nullable do_wait() passes wo->wo_pid to the sched_process_wait tracepoint. kernel_wait4() leaves wo_pid NULL for wait4(-1), and kernel_waitid_prepare() does likewise for waitid(P_ALL). btf_ctx_access() currently types argument 0 as PTR_TO_BTF_ID | PTR_TRUSTED. Without PTR_MAYBE_NULL, the verifier accepts an unchecked dereference. Trusted pointer loads have no fault protection, so a wait for any child can then cause a NULL pointer dereference in JITed BPF code. Add sched_process_wait to raw_tp_null_args[] with argument 0 marked nullable. The verifier rejects an unchecked dereference while preserving access after the program checks the pointer for NULL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98059

EUVD

EUVD-2026-86712

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) subsystem. The issue occurs when the sched_process_wait tracepoint argument is not properly marked as nullable. This can lead to a NULL pointer dereference in JITed BPF code if an unchecked dereference is performed, potentially causing a system crash or other unintended behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF subsystem and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors related to BPF or tracepoint operations. Commands like dmesg | grep -i 'bpf\|tracepoint\|null pointer' may help identify issues.

Impact Analysis

If exploited, this vulnerability could allow an attacker to trigger a NULL pointer dereference in BPF code, leading to a kernel panic or denial of service. Systems running unpatched Linux kernels with BPF enabled could be affected, though exploitation requires specific conditions and access.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue involving a NULL pointer dereference in BPF code due to improper handling of a nullable argument in the sched_process_wait tracepoint. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling BPF-related features or restricting unprivileged BPF usage via kernel parameters like kernel.unprivileged_bpf_disabled=1.

Hi! I’m here to help you understand CVE-2026-98059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70