Description
In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark signal tracepoint siginfo arguments as scalar

The signal_generate and signal_deliver tracepoints declare their info
argument as a struct kernel_siginfo pointer. btf_ctx_access() therefore
treats it as a trusted pointer for tp_btf programs.

Signal delivery also uses SEND_SIG_NOINFO and SEND_SIG_PRIV as special
values for this argument. Those values are zero and one respectively,
and are not pointers. A tp_btf program can currently dereference either
value and fault the kernel. In particular, signal_generate can run from
timer interrupt context, turning the fault into a kernel panic.

Record both tracepoints in raw_tp_null_args[] and mark argument one as
a non-pointer. This preserves scalar access to the cookie while rejecting
direct and helper-mediated pointer use. Merely marking it nullable would
not suffice because SEND_SIG_PRIV is nonzero.
Published: 2026-09-25
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel crash causing system denial of service
Action: Patch promptly
AI Analysis

Impact

The kernel’s signal tracepoints inaccurately treat the siginfo argument as a trusted pointer. The arguments can hold special scalar values, SEND_SIG_NOINFO and SEND_SIG_PRIV, which are not pointers. A BPF program that executes on these tracepoints may dereference those scalars, causing a fault that escalates to a kernel panic. This failure can occur in timer interrupt context, directly bypassing normal error handling and bringing the entire system down.

Affected Systems

All Linux kernel installations before the patch that marks the siginfo argument as scalar. This includes any distribution shipping a kernel before the commit LkML: a0e78cb242a57e481061fcb542fed4d51afba25c4 is applied.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. EPSS is reported as < 1%, marking exploitation probability as low. The vulnerability is not in the CISA KEV catalog. Exploitation requires the ability to load a custom tp_btf program, which typically demands local or privileged access. Therefore the attack vector is local BPF code execution; once introduced, it can bring the system down via a kernel panic.

Generated by OpenCVE AI on October 2, 2026 at 16:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the kernel to a version containing commit LkML: a0e78cb242a57e481061fcb542fed4d51afba25c4 or later.
  • Limit BPF program creation to trusted users or disable the BPF subsystem on untrusted interfaces; enforce the CAP_BPF capability only for necessary processes.
  • Set up automated monitoring of kernel panic events and establish recovery procedures, such as automatic reboot or fail‑over, to reduce downtime.

Generated by OpenCVE AI on October 2, 2026 at 16:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
CPEs cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*

Tue, 29 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-754

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-843
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Fri, 25 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-754

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signal_generate and signal_deliver tracepoints declare their info argument as a struct kernel_siginfo pointer. btf_ctx_access() therefore treats it as a trusted pointer for tp_btf programs. Signal delivery also uses SEND_SIG_NOINFO and SEND_SIG_PRIV as special values for this argument. Those values are zero and one respectively, and are not pointers. A tp_btf program can currently dereference either value and fault the kernel. In particular, signal_generate can run from timer interrupt context, turning the fault into a kernel panic. Record both tracepoints in raw_tp_null_args[] and mark argument one as a non-pointer. This preserves scalar access to the cookie while rejecting direct and helper-mediated pointer use. Merely marking it nullable would not suffice because SEND_SIG_PRIV is nonzero.
Title bpf: Mark signal tracepoint siginfo arguments as scalar
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:13:11.027Z

Reserved: 2026-09-25T10:19:56.073Z

Link: CVE-2026-98062

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-09-25T11:17:35.220

Modified: 2026-10-19T10:18:00.640

Link: CVE-2026-98062

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98062 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T17:00:17Z

Weaknesses
  • CWE-476

    NULL Pointer Dereference

  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')