CVE-2026-98655

What it actually does

Unprivileged processes can open task-local perf software events with text_poke enabled; exclude_kernel does not suppress PERF_RECORD_TEXT_POKE sideband records that contain raw kernel instruction addresses, allowing leakage of the runtime kernel text base despite KASLR.

Why it matters to the business

Attackers gain an information advantage that simplifies kernel exploitation on affected Linux systems, raising the likelihood of successful privilege escalation or persistence in environments that rely on KASLR for kernel protection.

How an attack unfolds

An unprivileged attacker opens a count-only software perf event with the text_poke attribute set, mmaps the ring buffer, then performs actions (such as opening a tracepoint or configuring UDP GRO for ESP-in-UDP) that trigger inline static call updates; the resulting PERF_RECORD_TEXT_POKE records deliver kernel addresses that, combined with a known kernel image, defeat KASLR.

How to fix it

Upgrade to a Linux kernel that enforces perf_allow_kernel() checks for any event with attr.text_poke set; apply the stable or distribution backport that resolves the permission check.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds the perf_allow_kernel() call when attr.text_poke is true; attempt to open a text_poke event as an unprivileged user and verify the operation now fails with EACCES.

Typical attack path

1. Create and open a perf_event_attr with type=PERF_TYPE_SOFTWARE, config=PERF_COUNT_SW_DUMMY, text_poke=1 and exclude_kernel=1
2. mmap the event ring buffer to receive sideband records
3. Trigger kernel text modifications by opening a tracepoint event or configuring network offloads
4. Parse received PERF_RECORD_TEXT_POKE records to extract kernel instruction addresses
5. Calculate the KASLR slide from known kernel symbols and proceed to kernel exploitation

How to detect it

Review audit logs or perf-related syscalls for unprivileged processes creating events with text_poke or PERF_RECORD_TEXT_POKE records appearing in non-root ring buffers; correlate with processes performing network or tracepoint configuration shortly before address leaks.

What your security team should do

• Prioritize kernel updates on any system exposing perf to untrusted workloads
• Audit unprivileged containers and user namespaces for perf_event_paranoid settings lower than 2
• Monitor for unexpected perf event creation by non-root processes in production environments