[CVE-2026-98062][LOW] bpf: Mark signal tracepoint siginfo arguments as scalar [ Upstream

[AL-KERNEL <alkernel@kernelcve.org>]

CVE: CVE-2026-98062
Priority: LOW
AL-KERNEL base severity: LOW
KPANIC flag: NO
Patch: bpf: Mark signal tracepoint siginfo arguments as scalar [ Upstream
Commit: 0e78cb242a57e481061fcb542fed4d51afba25c4
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0e78cb242a57e481061fcb542fed4d51afba25c4
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98062
Analysis date: Sat, 26 Sep 2026 16:50:26 -0400
ActionableScore: 0
ActionableScore lower bound: unknown
Actionable bucket: Ordinary Moderate
Manual review required: NO

Summary:
No one-sentence report phrase was found.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98062 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98062

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: LOW
Manual review required: NO

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-98062	LOW	https://www.kernelcve.org/list/?q=CVE-2026-98062 CHECK WITH IMPACT FROM ORIG NN LOW	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H';**CWE-476;CWE-843;*CWE-20;Other CVSS 'AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '5.5';DESCR 'A type mismatch in BTF tracepoint argument metadata exposes the signal info argument of signal_generate and signal_deliver as a trusted kernel_siginfo pointer to tp_btf BPF programs. The argument can instead contain SEND_SIG_NOINFO zero or SEND_SIG_PRIV one. A BPF program permitted to access this supposed pointer can cause an invalid kernel access. signal_generate may execute in timer interrupt context, where the resulting fault can panic the kernel. For the CVSS the PR:L paranoid score assumes a local constrained service or container workload has been delegated BPF tracing permissions. Standard systems typically require stronger privileges such as CAP_BPF with tracing related permissions, and unprivileged BPF is commonly disabled. The issue is not directly network reachable. Impact is kernel denial of service. The provided code does not establish a UAF, out of bounds write, information leak, or privilege escalation primitive.';NO MANUAL CHECK; ,and ActionableScore result is Ordinary Moderate (with actual score 0)	YES	BPF SIMPLEFIX SKB LINUS  INCREASED_FROM_LOW_BASED_ON_HIGHCVSSSCORE DECREASED_TO_MODERATEREG_BASED_ON_ACTIONABLESCORELESSTHAN4 DECREASED_TO_LOW_FROM_MODERATE_BASED_ON_ACTIONABLESCORELESSTHAN3	YES	NO	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=0
PrimitiveClass=CLASS_C
RealUAF=NO
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=UNKNOWN
ImportantCandidate=NO
ManualReview=NO
AutoDowngradeAllowed=YES

1. ActionableScore

* Raw conservative score: 0
* Conservative score: 0
* Raw paranoid score: 0
* Paranoid score: 0
* Final recommended bucket: **Ordinary Moderate**::

2. Signal breakdown

* +1 Reliable kernel crash or strong DoS. A tp_btf BPF program can dereference a signal info argument that is actually SEND_SIG_NOINFO zero or SEND_SIG_PRIV one. signal_generate can execute in timer interrupt context, where the invalid access can panic the kernel.
* -1 Reduced privileged control plane requirement. Loading and attaching the relevant tracing BPF program normally requires BPF and tracing related privileges such as CAP_BPF and CAP_PERFMON, or CAP_SYS_ADMIN on older capability models.

Non-awarded signals:

* No UAF, stale reference, refcount mutation, double release, or lifetime violation is established.
* No attacker-controlled kernel write, controlled reclaim, active object replacement, callback control, or arbitrary read or write is established.
* No confidentiality or integrity signal is awarded. The invalid value is zero or one and the patch establishes a fault path, not a disclosure or modification primitive.
* No remote reachability is established. The vulnerable operation is entered through a locally loaded and attached tp_btf BPF program.
* No local unprivileged trigger is awarded. The supplied evidence does not establish that an ordinary user can complete program load and tracepoint attachment.
* No extra availability point is awarded because the kernel panic is already counted as the single strong DoS signal.
* No paranoid uplift is awarded. The patch supports a crash-only invalid-pointer dereference, and does not support an additional corruption or privilege-escalation mechanism.

3. Reachability analysis

The evaluated attacker is a local process able to load and attach a tp_btf tracing BPF program to signal_generate or signal_deliver. The program can then attempt direct or helper-mediated access to the incorrectly typed signal info argument when the signal subsystem supplies SEND_SIG_NOINFO or SEND_SIG_PRIV instead of a kernel_siginfo pointer.

The complete privilege boundary is not visible in the supplied patch. Normal Linux BPF semantics indicate that tracing BPF load and attachment are privileged operations, generally requiring CAP_BPF plus tracing related permission such as CAP_PERFMON, or CAP_SYS_ADMIN on older kernels. This supports a reduced privileged-control-plane penalty, but does not prove that host-admin-equivalent privilege is always required for every evaluated product. Therefore HostAdminRequired is UNKNOWN.

Namespace-scoped reachability is also UNKNOWN. The patch does not show that program loading, BTF tracepoint attachment, and triggering can all be completed by an attacker using only capabilities in an attacker-controlled namespace. Container presence or delegated BPF capability alone would not establish that complete chain.

No special hardware, boot option, device setup, network exposure, or race is required by the described fault path. Unprivileged BPF is commonly disabled, but that is deployment context rather than an additional negative score.

4. Primitive and severity interpretation

The exact primitive is an invalid pointer dereference caused by semantic misclassification of a tracepoint argument. BTF metadata presents the signal info argument as a trusted kernel_siginfo pointer, while signal delivery may provide scalar sentinel values zero or one. A permitted BPF program can use the argument as if it were a valid pointer and fault the kernel.

This is not an active structured-object UAF, fixed stale storage issue, cleanup/destructor UAF, repeated release, refcount mutation, OOB write, or controlled type confusion. The patch changes verifier-visible argument classification so the value remains readable as a scalar cookie but cannot be used as a kernel pointer.

The demonstrated consequence is a local privileged kernel DoS, including possible panic from timer interrupt context. Privilege escalation, confidentiality impact, integrity impact, arbitrary kernel read or write, and controlled memory reuse remain speculative and are not supported by the patch.

PrimitiveClass is CLASS_C because the established behavior is invalid-state pointer use leading to crash or DoS without an independently useful corruption primitive. ImportantCandidate is NO because there is no unresolved active lifetime, ownership, authorization, or memory-corruption primitive requiring Important-versus-Moderate review. AutoDowngradeAllowed is YES because the patch-supported impact is constrained to privileged local DoS.

5. One-sentence report phrase

A privileged tp_btf BPF program can treat scalar signal sentinel values as trusted kernel_siginfo pointers and trigger a kernel panic through an invalid pointer dereference in signal tracepoint processing.

6. Manual review recommendation

NO MANUAL CHECK NEEDED

The patch establishes a privilege-gated local invalid-pointer crash path only, without UAF, write primitive, disclosure, authorization bypass, or demonstrated privilege-escalation leverage.

7. Call-site confidence

Call-site confidence: medium

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: bpf: Mark signal tracepoint siginfo arguments as scalar [ Upstream
Commit: 0e78cb242a57e481061fcb542fed4d51afba25c4
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0e78cb242a57e481061fcb542fed4d51afba25c4

Changed files:
  kernel/bpf/btf.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0e78cb242a57e481061fcb542fed4d51afba25c4

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98062 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98062

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS score: 5.5

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: unknown
  Paranoid ActionableScore: 0

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: LOW
KPANIC detected for this report: NO
Published priority for this report (same as in Subject): LOW

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).