Linux Kernel EUVD-2026-86715

Exploitation requires the local ability to load a BTF-enabled raw tracepoint (tp_btf) BPF program and attach it to the signal_generate or signal_deliver tracepoints - i.e., CAP_BPF plus CAP_PERFMON (or CAP_SYS_ADMIN) on a kernel built with BPF tracing (CONFIG_BPF_SYSCALL/BTF) enabled. The trigger is that the kernel passes the sentinel values SEND_SIG_NOINFO (0) or SEND_SIG_PRIV (1) in place of a struct kernel_siginfo pointer, which an unpatched program can dereference. Limiting factors: no remote vector, no network exposure, and a privilege requirement that typically restricts this to administrators or sufficiently privileged containers; systems without BPF tracing capability or without unprivileged BPF program loading are not exposed.

This is a genuine but low-to-moderate priority local denial-of-service issue, not an urgent remote threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) correctly captures it as local, low-complexity, requiring some privilege, with availability-only impact (a NULL/scalar dereference causing a kernel fault or, from timer-interrupt context, a panic) - CWE-476 is consistent. All signals agree on modest real-world risk: EPSS is only 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit is referenced. The signals are not conflicting - low EPSS, no KEV, and availability-only impact together point to a hardening/robustness fix rather than an actively weaponized bug. The practical constraint is that exploitation requires the ability to load a tp_btf (BTF-enabled tracing) BPF program attached to the signal_generate/signal_deliver tracepoints, which demands BPF/tracing privileges on the host, so this is primarily a local privilege-to-crash (or sandbox/container-escape-to-DoS) concern rather than a trivially reachable flaw.

A local actor with permission to load tracing BPF programs attaches a tp_btf program to the signal_generate or signal_deliver tracepoint and dereferences the siginfo argument when the kernel passes the special SEND_SIG_NOINFO (0) or SEND_SIG_PRIV (1) sentinel values instead of a real pointer. The resulting NULL/invalid dereference faults the kernel, and because signal_generate can fire in timer-interrupt context, the fault escalates to a full kernel panic. No public exploit code is referenced for this CVE.