{"id":"CVE-2026-98059","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark sched_process_wait argument as nullable\n\ndo_wait() passes wo->wo_pid to the sched_process_wait tracepoint.\nkernel_wait4() leaves wo_pid NULL for wait4(-1), an…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark sched_process_wait argument as nullable\n\ndo_wait() passes wo->wo_pid to the sched_process_wait tracepoint.\nkernel_wait4() leaves wo_pid NULL for wait4(-1), an…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"Linux","product":"Linux","affected":["Linux >= b2fc4b17fc13810ef440fb323fad3981cd174985 < bee862c79cb7e0e5c33b2df2e3a31d164705120d","Linux >= 838a10bd2ebfe11a60dd67687533a7cfc220cc86 < 3c03a1b8ded858685a73c1ba4080adef99db4544","Linux >= 838a10bd2ebfe11a60dd67687533a7cfc220cc86 < b9205e936dde9a94e93376c8de6195b740bcd5d2","Linux >= 838a10bd2ebfe11a60dd67687533a7cfc220cc86 < a453d6e3b8e8e1a321c8744d6189d763af9287d0","Linux >= 6.12.6 < 6.12.111","Linux 6.13"],"published":"2026-09-25","updated":"2026-09-30","sourceUpdated":"2026-09-30T14:10:59.253","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98059","references":[{"url":"https://git.kernel.org/stable/c/3c03a1b8ded858685a73c1ba4080adef99db4544","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a453d6e3b8e8e1a321c8744d6189d763af9287d0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9205e936dde9a94e93376c8de6195b740bcd5d2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bee862c79cb7e0e5c33b2df2e3a31d164705120d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98059.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98059"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2541275"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98059"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98059"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98059.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00168,"epssPercentile":0.06057,"cvssSource":"vendor","ingestedAt":"2026-09-25T11:06:38.844Z","slug":"CVE-2026-98059","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark sched_process_wait argument as nullable\n\ndo_wait() passes wo->wo_pid to the sched_process_wait tracepoint.\nkernel_wait4() leaves wo_pid NULL for wait4(-1), and\nkernel_waitid_prepare() does likewise for waitid(P_ALL).\n\nbtf_ctx_access() currently types argument 0 as PTR_TO_BTF_ID |\nPTR_TRUSTED. Without PTR_MAYBE_NULL, the verifier accepts an unchecked\ndereference. Trusted pointer loads have no fault protection, so a wait for\nany child can then cause a NULL pointer dereference in JITed BPF code.\n\nAdd sched_process_wait to raw_tp_null_args[] with argument 0 marked\nnullable. The verifier rejects an unchecked dereference while preserving\naccess after the program checks the pointer for NULL.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98059.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":212382,"id":"CVE-2026-98059","ts":1790668160855,"field":"cvss","old":null,"new":"5.5"},{"seq":212381,"id":"CVE-2026-98059","ts":1790668160855,"field":"severity","old":"none","new":"medium"}]}