{"id":"CVE-2026-98059","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark sched_process_wait argument as nullable\n\ndo_wait() passes wo->wo_pid to the sched_process_wait tracepoint.\nkernel_wait4() leaves wo_pid NULL for wait4(-1), an…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark sched_process_wait argument as nullable\n\ndo_wait() passes wo->wo_pid to the sched_process_wait tracepoint.\nkernel_wait4() leaves wo_pid NULL for wait4(-1), an…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= b2fc4b17fc13810ef440fb323fad3981cd174985 < bee862c79cb7e0e5c33b2df2e3a31d164705120d","Linux >= 838a10bd2ebfe11a60dd67687533a7cfc220cc86 < 3c03a1b8ded858685a73c1ba4080adef99db4544","Linux >= 838a10bd2ebfe11a60dd67687533a7cfc220cc86 < b9205e936dde9a94e93376c8de6195b740bcd5d2","Linux >= 838a10bd2ebfe11a60dd67687533a7cfc220cc86 < a453d6e3b8e8e1a321c8744d6189d763af9287d0","Linux >= 6.12.6 < 6.12.111","Linux 6.13"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T11:17:34.873","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98059","references":[{"url":"https://git.kernel.org/stable/c/3c03a1b8ded858685a73c1ba4080adef99db4544","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a453d6e3b8e8e1a321c8744d6189d763af9287d0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9205e936dde9a94e93376c8de6195b740bcd5d2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bee862c79cb7e0e5c33b2df2e3a31d164705120d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T11:06:38.844Z","slug":"CVE-2026-98059","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark sched_process_wait argument as nullable\n\ndo_wait() passes wo->wo_pid to the sched_process_wait tracepoint.\nkernel_wait4() leaves wo_pid NULL for wait4(-1), and\nkernel_waitid_prepare() does likewise for waitid(P_ALL).\n\nbtf_ctx_access() currently types argument 0 as PTR_TO_BTF_ID |\nPTR_TRUSTED. Without PTR_MAYBE_NULL, the verifier accepts an unchecked\ndereference. Trusted pointer loads have no fault protection, so a wait for\nany child can then cause a NULL pointer dereference in JITed BPF code.\n\nAdd sched_process_wait to raw_tp_null_args[] with argument 0 marked\nnullable. The verifier rejects an unchecked dereference while preserving\naccess after the program checks the pointer for NULL.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}