From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-98062][LOW] bpf: Mark signal tracepoint siginfo arguments as scalar [ Upstream Date: Sat, 26 Sep 2026 16:50:26 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-98062 X-AL-KERNEL-Priority: LOW X-AL-KERNEL-Severity: LOW X-AL-KERNEL-Base-Severity: LOW X-AL-KERNEL-KPANIC: NO X-AL-KERNEL-ActionableScore: 0 X-AL-KERNEL-ActionableScore-Lower: unknown X-AL-KERNEL-Commit: 0e78cb242a57e481061fcb542fed4d51afba25c4 List-Id: CVE: CVE-2026-98062 Priority: LOW AL-KERNEL base severity: LOW KPANIC flag: NO Patch: bpf: Mark signal tracepoint siginfo arguments as scalar [ Upstream Commit: 0e78cb242a57e481061fcb542fed4d51afba25c4 Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0e78cb242a57e481061fcb542fed4d51afba25c4 Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98062 Analysis date: Sat, 26 Sep 2026 16:50:26 -0400 ActionableScore: 0 ActionableScore lower bound: unknown Actionable bucket: Ordinary Moderate Manual review required: NO Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-98062 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98062 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: LOW Manual review required: NO A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-98062 LOW https://www.kernelcve.org/list/?q=CVE-2026-98062 CHECK WITH IMPACT FROM ORIG NN LOW Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H';**CWE-476;CWE-843;*CWE-20;Other CVSS 'AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '5.5';DESCR 'A type mismatch in BTF tracepoint argument metadata exposes the signal info argument of signal_generate and signal_deliver as a trusted kernel_siginfo pointer to tp_btf BPF programs. The argument can instead contain SEND_SIG_NOINFO zero or SEND_SIG_PRIV one. A BPF program permitted to access this supposed pointer can cause an invalid kernel access. signal_generate may execute in timer interrupt context, where the resulting fault can panic the kernel. For the CVSS the PR:L paranoid score assumes a local constrained service or container workload has been delegated BPF tracing permissions. Standard systems typically require stronger privileges such as CAP_BPF with tracing related permissions, and unprivileged BPF is commonly disabled. The issue is not directly network reachable. Impact is kernel denial of service. The provided code does not establish a UAF, out of bounds write, information leak, or privilege escalation primitive.';NO MANUAL CHECK; ,and ActionableScore result is Ordinary Moderate (with actual score 0) YES BPF SIMPLEFIX SKB LINUS INCREASED_FROM_LOW_BASED_ON_HIGHCVSSSCORE DECREASED_TO_MODERATEREG_BASED_ON_ACTIONABLESCORELESSTHAN4 DECREASED_TO_LOW_FROM_MODERATE_BASED_ON_ACTIONABLESCORELESSTHAN3 YES NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=0 PrimitiveClass=CLASS_C RealUAF=NO HostAdminRequired=UNKNOWN NamespaceScopedPrivilege=UNKNOWN ImportantCandidate=NO ManualReview=NO AutoDowngradeAllowed=YES 1. ActionableScore * Raw conservative score: 0 * Conservative score: 0 * Raw paranoid score: 0 * Paranoid score: 0 * Final recommended bucket: **Ordinary Moderate**:: 2. Signal breakdown * +1 Reliable kernel crash or strong DoS. A tp_btf BPF program can dereference a signal info argument that is actually SEND_SIG_NOINFO zero or SEND_SIG_PRIV one. signal_generate can execute in timer interrupt context, where the invalid access can panic the kernel. * -1 Reduced privileged control plane requirement. Loading and attaching the relevant tracing BPF program normally requires BPF and tracing related privileges such as CAP_BPF and CAP_PERFMON, or CAP_SYS_ADMIN on older capability models. Non-awarded signals: * No UAF, stale reference, refcount mutation, double release, or lifetime violation is established. * No attacker-controlled kernel write, controlled reclaim, active object replacement, callback control, or arbitrary read or write is established. * No confidentiality or integrity signal is awarded. The invalid value is zero or one and the patch establishes a fault path, not a disclosure or modification primitive. * No remote reachability is established. The vulnerable operation is entered through a locally loaded and attached tp_btf BPF program. * No local unprivileged trigger is awarded. The supplied evidence does not establish that an ordinary user can complete program load and tracepoint attachment. * No extra availability point is awarded because the kernel panic is already counted as the single strong DoS signal. * No paranoid uplift is awarded. The patch supports a crash-only invalid-pointer dereference, and does not support an additional corruption or privilege-escalation mechanism. 3. Reachability analysis The evaluated attacker is a local process able to load and attach a tp_btf tracing BPF program to signal_generate or signal_deliver. The program can then attempt direct or helper-mediated access to the incorrectly typed signal info argument when the signal subsystem supplies SEND_SIG_NOINFO or SEND_SIG_PRIV instead of a kernel_siginfo pointer. The complete privilege boundary is not visible in the supplied patch. Normal Linux BPF semantics indicate that tracing BPF load and attachment are privileged operations, generally requiring CAP_BPF plus tracing related permission such as CAP_PERFMON, or CAP_SYS_ADMIN on older kernels. This supports a reduced privileged-control-plane penalty, but does not prove that host-admin-equivalent privilege is always required for every evaluated product. Therefore HostAdminRequired is UNKNOWN. Namespace-scoped reachability is also UNKNOWN. The patch does not show that program loading, BTF tracepoint attachment, and triggering can all be completed by an attacker using only capabilities in an attacker-controlled namespace. Container presence or delegated BPF capability alone would not establish that complete chain. No special hardware, boot option, device setup, network exposure, or race is required by the described fault path. Unprivileged BPF is commonly disabled, but that is deployment context rather than an additional negative score. 4. Primitive and severity interpretation The exact primitive is an invalid pointer dereference caused by semantic misclassification of a tracepoint argument. BTF metadata presents the signal info argument as a trusted kernel_siginfo pointer, while signal delivery may provide scalar sentinel values zero or one. A permitted BPF program can use the argument as if it were a valid pointer and fault the kernel. This is not an active structured-object UAF, fixed stale storage issue, cleanup/destructor UAF, repeated release, refcount mutation, OOB write, or controlled type confusion. The patch changes verifier-visible argument classification so the value remains readable as a scalar cookie but cannot be used as a kernel pointer. The demonstrated consequence is a local privileged kernel DoS, including possible panic from timer interrupt context. Privilege escalation, confidentiality impact, integrity impact, arbitrary kernel read or write, and controlled memory reuse remain speculative and are not supported by the patch. PrimitiveClass is CLASS_C because the established behavior is invalid-state pointer use leading to crash or DoS without an independently useful corruption primitive. ImportantCandidate is NO because there is no unresolved active lifetime, ownership, authorization, or memory-corruption primitive requiring Important-versus-Moderate review. AutoDowngradeAllowed is YES because the patch-supported impact is constrained to privileged local DoS. 5. One-sentence report phrase A privileged tp_btf BPF program can treat scalar signal sentinel values as trusted kernel_siginfo pointers and trigger a kernel panic through an invalid pointer dereference in signal tracepoint processing. 6. Manual review recommendation NO MANUAL CHECK NEEDED The patch establishes a privilege-gated local invalid-pointer crash path only, without UAF, write primitive, disclosure, authorization bypass, or demonstrated privilege-escalation leverage. 7. Call-site confidence Call-site confidence: medium ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: bpf: Mark signal tracepoint siginfo arguments as scalar [ Upstream Commit: 0e78cb242a57e481061fcb542fed4d51afba25c4 Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0e78cb242a57e481061fcb542fed4d51afba25c4 Changed files: kernel/bpf/btf.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0e78cb242a57e481061fcb542fed4d51afba25c4 ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-98062 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98062 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS score: 5.5 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: unknown Paranoid ActionableScore: 0 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: LOW KPANIC detected for this report: NO Published priority for this report (same as in Subject): LOW These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).