UBUNTU-CVE-2026-98059: Null Pointer Dereference

Q: Who can trigger the crash?

An attacker needs the ability to load or run a JITed BPF program that attaches to the sched_process_wait tracepoint. They must also be able to cause a wait operation for any child, such as wait4(-1) or waitid(P_ALL), which supplies a NULL PID argument to that tracepoint.

Q: What is the impact of successful exploitation?

An unchecked dereference of the nullable tracepoint argument can cause a NULL pointer dereference in JITed BPF code. The stated impact is denial of service through system availability loss; no confidentiality or integrity impact is described.

Q: Are all wait operations affected?

The vulnerable condition occurs when the tracepoint's first argument is NULL, specifically for wait4(-1) and waitid(P_ALL). Wait operations that provide a specific child PID do not match the NULL-argument condition described.

Q: What changes in the fix?

The fix marks argument 0 of sched_process_wait as nullable in the BPF verifier. Unchecked dereferences are then rejected, while BPF programs that first check the pointer for NULL retain access.

Published Sep 25, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait() passes wo->wopid to the schedprocesswait tracepoint. kernelwait4() leaves wopid NULL for wait4(-1), and kernelwaitidprepare() does likewise for waitid(PALL). btfctxaccess() currently types argument 0 as PTRTOBTFID | PTRTRUSTED. Without PTRMAYBENULL, the verifier accepts an unchecked dereference. Trusted pointer loads have no fault protection, so a wait for any child can then cause a NULL pointer dereference in JITed BPF code. Add schedprocesswait to rawtpnullargs[] with argument 0 marked nullable. The verifier rejects an unchecked dereference while preserving access after the program checks the pointer for NULL.

Affected Software

128 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0*

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-42.42~24.04.1

7.0.0-42.42~24.04.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-42.42.1~24.04.1

7.0.0-42.42.1~24.04.1

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux<7.0.0-42.42

7.0.0-42.42

ubuntu/linux-aws<7.0.0-1016.17

7.0.0-1016.17

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<7.0.0-1016.18

7.0.0-1016.18

ubuntu/linux-gke*

ubuntu/linux-ibm<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos*

ubuntu/linux-oem-7.0<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-oracle<7.0.0-1015.16

7.0.0-1015.16

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv<7.0.0-42.42.1

7.0.0-42.42.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.17
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.18
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.16
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-42.42.1
Configuration
Add sched_process_wait to raw_tp_null_args[] and mark argument 0 as nullable.
Linux kernel BPF verifier raw_tp_null_args[] for sched_process_wait = argument 0 nullable

Event History

Sep 25, 2026

CVE Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can trigger the crash?

An attacker needs the ability to load or run a JITed BPF program that attaches to the sched_process_wait tracepoint. They must also be able to cause a wait operation for any child, such as wait4(-1) or waitid(P_ALL), which supplies a NULL PID argument to that tracepoint.

What is the impact of successful exploitation?

An unchecked dereference of the nullable tracepoint argument can cause a NULL pointer dereference in JITed BPF code. The stated impact is denial of service through system availability loss; no confidentiality or integrity impact is described.

Are all wait operations affected?

The vulnerable condition occurs when the tracepoint's first argument is NULL, specifically for wait4(-1) and waitid(P_ALL). Wait operations that provide a specific child PID do not match the NULL-argument condition described.

What changes in the fix?

The fix marks argument 0 of sched_process_wait as nullable in the BPF verifier. Unchecked dereferences are then rejected, while BPF programs that first check the pointer for NULL retain access.

UBUNTU-CVE-2026-98059: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can trigger the crash?

What is the impact of successful exploitation?

Are all wait operations affected?

What changes in the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the crash?

What is the impact of successful exploitation?

Are all wait operations affected?

What changes in the fix?