CVE-2026-98062: bpf: Mark signal tracepoint siginfo arguments as scalar
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark signal tracepoint siginfo arguments as scalar
The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess() therefore treats it as a trusted pointer for tpbtf programs.
Signal delivery also uses SENDSIGNOINFO and SENDSIGPRIV as special values for this argument. Those values are zero and one respectively, and are not pointers. A tpbtf program can currently dereference either value and fault the kernel. In particular, signalgenerate can run from timer interrupt context, turning the fault into a kernel panic.
Record both tracepoints in rawtpnullargs[] and mark argument one as a non-pointer. This preserves scalar access to the cookie while rejecting direct and helper-mediated pointer use. Merely marking it nullable would not suffice because SENDSIGPRIV is nonzero.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The issue requires loading or running a tp_btf BPF program that attaches to the signal_generate or signal_deliver tracepoint and dereferences the tracepoint's info argument. The provided data does not identify the specific permissions required to load such a program.
What impact can exploitation have?
A BPF program can dereference the special zero or one values used for the info argument, causing a kernel fault. Because signal_generate may execute in timer interrupt context, the fault can result in a kernel panic.
Are normal signal-info values affected?
The unsafe cases are the SEND_SIG_NOINFO and SEND_SIG_PRIV special values, represented by zero and one rather than valid pointers. The fix preserves scalar access to the argument, described as a cookie, while blocking direct and helper-mediated use as a pointer.
How can exposure be reduced before the fix is applied?
Avoid allowing tp_btf BPF programs to attach to signal_generate or signal_deliver, especially programs that treat the info argument as a pointer. The supplied data does not provide a configuration-only mitigation beyond restricting this BPF usage.