{"id":"CVE-2026-98059","revision":"391d14ec1bed401682601b882fd18406","records":[{"revision":"391d14ec1bed401682601b882fd18406","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98059","aliases":[],"title":"bpf: Mark sched_process_wait argument as nullable","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark sched_process_wait argument as nullable\n\ndo_wait() passes wo->wo_pid to the sched_process_wait tracepoint.\nkernel_wait4() leaves wo_pid NULL for wait4(-1), and\nkernel_waitid_prepare() does likewise for waitid(P_ALL).\n\nbtf_ctx_access() currently types argument 0 as PTR_TO_BTF_ID |\nPTR_TRUSTED. Without PTR_MAYBE_NULL, the verifier accepts an unchecked\ndereference. Trusted pointer loads have no fault protection, so a wait for\nany child can then cause a NULL pointer dereference in JITed BPF code.\n\nAdd sched_process_wait to raw_tp_null_args[] with argument 0 marked\nnullable. The verifier rejects an unchecked dereference while preserving\naccess after the program checks the pointer for NULL.","state":0,"publishedAt":"2026-09-25T10:24:04.788+00:00","modifiedAt":"2026-10-19T09:13:06.971+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/btf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b2fc4b17fc13810ef440fb323fad3981cd174985\",\n                            \"lessThan\": \"bee862c79cb7e0e5c33b2df2e3a31d164705120d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"838a10bd2ebfe11a60dd67687533a7cfc220cc86\",\n                            \"lessThan\": \"3c03a1b8ded858685a73c1ba4080adef99db4544\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"838a10bd2ebfe11a60dd67687533a7cfc220cc86\",\n                            \"lessThan\": \"b9205e936dde9a94e93376c8de6195b740bcd5d2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"838a10bd2ebfe11a60dd67687533a7cfc220cc86\",\n                            \"lessThan\": \"a453d6e3b8e8e1a321c8744d6189d763af9287d0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.12.6\",\n                            \"lessThan\": \"6.12.111\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/btf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/bee862c79cb7e0e5c33b2df2e3a31d164705120d","https://git.kernel.org/stable/c/3c03a1b8ded858685a73c1ba4080adef99db4544","https://git.kernel.org/stable/c/b9205e936dde9a94e93376c8de6195b740bcd5d2","https://git.kernel.org/stable/c/a453d6e3b8e8e1a321c8744d6189d763af9287d0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98059","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98059","identifiers":["CVE-2026-98059"]},"retained":false,"historicalAffected":[]}],"coverage":[]}