CVE-2026-98059

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. This issue allows a local attacker to cause a Denial of Service (DoS) through a system crash. The vulnerability occurs because the BPF verifier fails to recognize that process-wait tracepoint arguments can be null, permitting unchecked pointer dereferences. A local user can trigger this condition by issuing wait system calls that pass null process identifiers, resulting in a kernel null pointer dereference.

A low impact NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem, affecting the kernel in Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2, as well as the OpenShift Container Platform releases that ship an affected RHEL 9 kernel. The BPF verifier did not mark argument 0 of the sched_process_wait tracepoint as nullable, so a BPF program attached to that tracepoint could perform an unchecked dereference when a process waits for any child (for example via wait4(-1) or waitid(P_ALL)), causing a NULL pointer dereference in JITed BPF code that crashes the kernel and results in a local denial of service. Exploitation requires local access and the ability to load and attach a raw tracepoint BPF program, which is a privileged operation; because such access already implies elevated BPF privileges, Red Hat rates the impact of this issue as LOW even though the CVSS 3.1 score is 5.5 (MODERATE). Older Red Hat Enterprise Linux releases and streams (RHEL 6, 7, 8, and earlier RHEL 9/RHEL 10 z-streams) are not affected because the vulnerable code is not present. Fixes for the affected streams are currently deferred given the low severity and the privileged access required to trigger the flaw; the residual risk is limited to a local denial of service by a user who already holds the BPF capabilities needed to load and attach such a program.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.