CVE-2026-98062Medium· 5.5▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signal_generate and signal_deliver tracepoints declare their info argument as a struct kernel_siginfo point…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
— → 5.5
none → medium
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark signal tracepoint siginfo arguments as scalar
The signal_generate and signal_deliver tracepoints declare their info argument as a struct kernel_siginfo pointer. btf_ctx_access() therefore treats it as a trusted pointer for tp_btf programs.
Signal delivery also uses SEND_SIG_NOINFO and SEND_SIG_PRIV as special values for this argument. Those values are zero and one respectively, and are not pointers. A tp_btf program can currently dereference either value and fault the kernel. In particular, signal_generate can run from timer interrupt context, turning the fault into a kernel panic.
Record both tracepoints in raw_tp_null_args[] and mark argument one as a non-pointer. This preserves scalar access to the cookie while rejecting direct and helper-mediated pointer use. Merely marking it nullable would not suffice because SEND_SIG_PRIV is nonzero.
linux_kernel >= 6.12.6, < 6.13linux_kernel >= 6.13.1, < 6.18.53linux_kernel >= 6.19, < 7.2.7linux_kernel = 6.13linux_kernel = 7.3Upgrade past the affected range:
linux_kernel 7.2.7Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-36558Medium· 5.1A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.
CVE-2020-11609Medium· 4.3An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1
CVE-2019-16089Medium· 4.1An issue was discovered in the Linux kernel through 5.2.13
CVE-2022-0500High· 7.8A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF
CVE-2021-38198Medium· 5.5arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.
CVE-2020-36311Medium· 5.5An issue was discovered in the Linux kernel before 5.9