-

CVE-2026-98059

bpf: Mark sched_process_wait argument as nullable

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark sched_process_wait argument as nullable

do_wait() passes wo->wo_pid to the sched_process_wait tracepoint.
kernel_wait4() leaves wo_pid NULL for wait4(-1), and
kernel_waitid_prepare() does likewise for waitid(P_ALL).

btf_ctx_access() currently types argument 0 as PTR_TO_BTF_ID |
PTR_TRUSTED. Without PTR_MAYBE_NULL, the verifier accepts an unchecked
dereference. Trusted pointer loads have no fault protection, so a wait for
any child can then cause a NULL pointer dereference in JITed BPF code.

Add sched_process_wait to raw_tp_null_args[] with argument 0 marked
nullable. The verifier rejects an unchecked dereference while preserving
access after the program checks the pointer for NULL.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version b2fc4b17fc13810ef440fb323fad3981cd174985
Version < bee862c79cb7e0e5c33b2df2e3a31d164705120d
Status affected
Version 838a10bd2ebfe11a60dd67687533a7cfc220cc86
Version < 3c03a1b8ded858685a73c1ba4080adef99db4544
Status affected
Version 838a10bd2ebfe11a60dd67687533a7cfc220cc86
Version < b9205e936dde9a94e93376c8de6195b740bcd5d2
Status affected
Version 838a10bd2ebfe11a60dd67687533a7cfc220cc86
Version < a453d6e3b8e8e1a321c8744d6189d763af9287d0
Status affected
Version 6.12.6
Version < 6.12.111
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.13
Status affected
Version 0
Version < 6.13
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.53
Status unaffected
Version <= 7.2.*
Version 7.2.7
Status unaffected
Version <= *
Version 7.3-rc2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.054
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/bee862c79cb7e0e5c33b2df2e3a31d164705120d
https://git.kernel.org/stable/c/3c03a1b8ded858685a73c1ba4080adef99db4544
https://git.kernel.org/stable/c/b9205e936dde9a94e93376c8de6195b740bcd5d2
https://git.kernel.org/stable/c/a453d6e3b8e8e1a321c8744d6189d763af9287d0