CVE-2026-98059: bpf: Mark sched_process_wait argument as nullable
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark schedprocesswait argument as nullable
dowait() passes wo->wopid to the schedprocesswait tracepoint. kernelwait4() leaves wopid NULL for wait4(-1), and kernelwaitidprepare() does likewise for waitid(PALL).
btfctxaccess() currently types argument 0 as PTRTOBTFID | PTRTRUSTED. Without PTRMAYBENULL, the verifier accepts an unchecked dereference. Trusted pointer loads have no fault protection, so a wait for any child can then cause a NULL pointer dereference in JITed BPF code.
Add schedprocesswait to rawtpnullargs[] with argument 0 marked nullable. The verifier rejects an unchecked dereference while preserving access after the program checks the pointer for NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.7-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Add sched_process_wait to raw_tp_null_args[] and mark argument 0 as nullable so the verifier preserves NULL checks and prevents unchecked trusted-pointer dereferences.
Linux kernel BPF raw tracepoints raw_tp_null_args[] = sched_process_wait argument 0 nullable
Event History
Frequently Asked Questions
What conditions are required to trigger the NULL pointer dereference?
A JITed BPF program must attach to the sched_process_wait tracepoint and dereference its first argument without checking for NULL. The tracepoint receives a NULL pid pointer when a process waits for any child using wait4(-1) or waitid(P_ALL).
Who is realistically exposed to this issue?
Systems that permit loading an affected JITed BPF program are exposed. Triggering the fault also requires a wait operation for any child to reach the sched_process_wait tracepoint while that program is active.
What changes after the fix is applied?
The verifier treats sched_process_wait argument 0 as nullable and rejects BPF programs that dereference it without a NULL check. Programs can still access the argument after explicitly verifying that it is non-NULL.