SB20260928147 - NULL pointer dereference in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-98059)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper null pointer handling in the BPF verifier handling of the sched_process_wait tracepoint argument when executing a JITed BPF program that dereferences the argument without a NULL check. A local user can execute a JITed BPF program with an unchecked dereference and trigger a wait for any child to cause a denial of service.

The tracepoint argument can be NULL for wait4(-1) and waitid(P_ALL).

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3c03a1b8ded858685a73c1ba4080adef99db4544
• https://git.kernel.org/stable/c/a453d6e3b8e8e1a321c8744d6189d763af9287d0
• https://git.kernel.org/stable/c/b9205e936dde9a94e93376c8de6195b740bcd5d2
• https://git.kernel.org/stable/c/bee862c79cb7e0e5c33b2df2e3a31d164705120d