CVE-2026-98062

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark signal tracepoint siginfo arguments as scalar

The signal generate and signal deliver tracepoints declare their info argument as a struct kernel siginfo pointer. btf ctx access() therefore treats it as a trusted pointer for tp btf programs.

Signal delivery also uses SEND SIG NOINFO and SEND SIG PRIV as special values for this argument. Those values are zero and one respectively, and are not pointers. A tp btf program can currently dereference either value and fault the kernel. In particular, signal generate can run from timer interrupt context, turning the fault into a kernel panic.

Record both tracepoints in raw tp null args[] and mark argument one as a non-pointer. This preserves scalar access to the cookie while rejecting direct and helper-mediated pointer use. Merely marking it nullable would not suffice because SEND SIG PRIV is nonzero.