CVE-2026-98059: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98059 Overview

CVE-2026-98059 is a NULL pointer dereference vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The flaw resides in the sched_process_wait tracepoint, where the first argument can be NULL but was incorrectly typed as a trusted non-nullable pointer. When do_wait() passes wo->wo_pid to the tracepoint, callers such as kernel_wait4() for wait4(-1) and kernel_waitid_prepare() for waitid(P_ALL) leave wo_pid set to NULL. A BPF program attached to this tracepoint can dereference the pointer without a NULL check, causing a kernel crash whenever a process waits on any child.

Critical Impact
A local user with permission to load raw tracepoint BPF programs can trigger a kernel NULL pointer dereference, resulting in denial of service through a kernel panic.

Affected Products

Linux kernel versions containing the sched_process_wait tracepoint with the unpatched btf_ctx_access() typing
Linux stable kernel branches prior to the fix commits
Distributions shipping affected upstream kernels

Discovery Timeline

2026-09-25 - CVE-2026-98059 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98059

Vulnerability Analysis

The Linux kernel exposes the sched_process_wait tracepoint to allow BPF programs to observe process-wait events. The function btf_ctx_access() controls how the BPF verifier types tracepoint arguments. For this tracepoint, argument 0 was typed as PTR_TO_BTF_ID | PTR_TRUSTED without the PTR_MAYBE_NULL flag.

The PTR_TRUSTED tag tells the verifier that the pointer is valid and does not require a NULL check before dereferencing. The verifier therefore accepts load instructions that unconditionally dereference the pointer. Trusted pointer loads in JITed BPF code have no fault-handling fixup, so a dereference of a NULL address faults in kernel context.

When a BPF program attached to sched_process_wait runs during a wait4(-1) or waitid(P_ALL) syscall, wo_pid is NULL. The JITed program dereferences the NULL pointer, producing an oops and typically a kernel panic depending on configuration.

Root Cause

The root cause is incorrect verifier metadata for a tracepoint argument. The wo_pid pointer passed to sched_process_wait is legitimately nullable because do_wait() is invoked from code paths that do not target a specific pid structure. The verifier did not know this, so it allowed programs to skip the NULL check that would normally be required for a PTR_MAYBE_NULL pointer [CWE-476].

Attack Vector

Exploitation requires the ability to load a raw tracepoint BPF program, which typically requires CAP_BPF or CAP_SYS_ADMIN. An attacker loads a BPF program attached to sched_process_wait that dereferences argument 0 without a NULL check. Any process on the system that subsequently calls wait4(-1) or waitid(P_ALL) triggers the dereference, crashing the kernel. The upstream fix adds sched_process_wait to raw_tp_null_args[] with argument 0 marked nullable, forcing the verifier to reject unchecked dereferences while still permitting access after an explicit NULL check in the BPF program.

See the upstream patches for the exact changes: Kernel Git Commit 3c03a1b8, Kernel Git Commit a453d6e3, Kernel Git Commit b9205e93, and Kernel Git Commit bee862c7.

Detection Methods for CVE-2026-98059

Indicators of Compromise

Kernel oops or panic messages referencing a NULL pointer dereference inside a JITed BPF program during process wait operations
Unexpected system crashes correlated with wait4() or waitid() syscalls on hosts running custom BPF tracing
dmesg entries containing BUG: kernel NULL pointer dereference with a call trace through sched_process_wait or do_wait

Detection Strategies

Audit loaded BPF programs with bpftool prog list and inspect any program attached to the sched_process_wait raw tracepoint
Review BPF source for programs that read from argument 0 of sched_process_wait without a prior NULL check
Monitor kernel log collection pipelines for sudden spikes in kernel oops events on hosts with eBPF-based observability tools

Monitoring Recommendations

Centralize dmesg and /var/log/kern.log output in a log analytics platform to catch BPF-related oops entries
Track CAP_BPF and CAP_SYS_ADMIN capability grants on production systems to limit who can load tracepoint programs
Alert on unexpected bpf() syscalls originating from non-administrative user contexts

How to Mitigate CVE-2026-98059

Immediate Actions Required

Apply the upstream stable kernel update containing the raw_tp_null_args[] entry for sched_process_wait
Inventory and review all in-house BPF programs attached to sched_process_wait for missing NULL checks on argument 0
Restrict CAP_BPF and CAP_SYS_ADMIN on multi-tenant and production hosts to administrative users only

Patch Information

The fix adds sched_process_wait to the raw_tp_null_args[] table with argument 0 marked nullable. The verifier then rejects unchecked dereferences and still allows access once the program compares the pointer against NULL. Upstream commits are available at Kernel Git Commit 3c03a1b8, Kernel Git Commit a453d6e3, Kernel Git Commit b9205e93, and Kernel Git Commit bee862c7. Distribution-provided kernel updates incorporating these commits should be deployed as they become available.

Workarounds

Unload or disable BPF programs attached to the sched_process_wait tracepoint until the patched kernel is installed
Modify in-house BPF programs to explicitly check argument 0 for NULL before any dereference
Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading BPF programs

bash

# Disable unprivileged BPF program loading
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee -a /etc/sysctl.d/90-bpf.conf

# List BPF programs attached to raw tracepoints
sudo bpftool prog list | grep -i raw_tracepoint

# Detach a specific program by id (replace <ID>)
sudo bpftool prog detach id <ID>