CVE-2026-98062
Received Received - Intake

BPF Signal Tracepoint Argument Validation Bypass

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signal_generate and signal_deliver tracepoints declare their info argument as a struct kernel_siginfo pointer. btf_ctx_access() therefore treats it as a trusted pointer for tp_btf programs. Signal delivery also uses SEND_SIG_NOINFO and SEND_SIG_PRIV as special values for this argument. Those values are zero and one respectively, and are not pointers. A tp_btf program can currently dereference either value and fault the kernel. In particular, signal_generate can run from timer interrupt context, turning the fault into a kernel panic. Record both tracepoints in raw_tp_null_args[] and mark argument one as a non-pointer. This preserves scalar access to the cookie while rejecting direct and helper-mediated pointer use. Merely marking it nullable would not suffice because SEND_SIG_PRIV is nonzero.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98062
EUVD
EUVD-2026-86715

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in how BPF (Berkeley Packet Filter) programs handle signal tracepoint arguments. The signal_generate and signal_deliver tracepoints incorrectly treat the info argument as a trusted pointer, allowing tp_btf programs to dereference special values like SEND_SIG_NOINFO (zero) and SEND_SIG_PRIV (one), which are not pointers. This can cause a kernel fault and panic, especially when triggered from timer interrupt context.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and relates to signal tracepoint handling. Detection requires checking kernel version and BPF-related components. Use commands like 'uname -a' to check kernel version and 'lsmod | grep bpf' to verify BPF module status. Monitor kernel logs for tracepoint-related errors or panics.

Impact Analysis

This vulnerability could lead to a kernel panic, causing system crashes and potential denial of service. If exploited, it may allow local attackers to trigger crashes by manipulating signal delivery, affecting system stability and availability.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If a patch is unavailable, consider disabling BPF-related features temporarily or restricting access to BPF programs via kernel parameters. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart