Cloudanix VulnDB

CVE-2026-98969

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux networking code can let certain privileged local users read pieces of hidden kernel memory by sending crafted network-filter rules.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in em_text_change() that discloses adjacent kernel memory when an unterminated 16-byte algo array is passed to textsearch_prepare() on TS_AUTOLOAD, resulting in the leaked bytes being supplied to the usermode modprobe command line.

Why it matters to the business

Local attackers with network configuration privileges can obtain fragments of kernel memory, raising the risk of sensitive data exposure and follow-on attacks in systems that rely on Linux traffic control features.

How an attack unfolds

An attacker with CAP_NET_ADMIN in a network namespace installs a clsact qdisc, then adds a basic filter containing a text ematch whose algo field is exactly 16 bytes with no NUL terminator; textsearch_prepare() triggers request_module with a module name built from the over-read bytes, disclosing kernel memory via the usermode helper.

How to fix it

Apply the upstream fix that adds an explicit NUL-terminator check inside em_text_change() before calling textsearch_prepare(); rebuild and deploy updated kernel packages to all affected systems.

How to confirm the fix worked

Confirm the NUL-terminator rejection logic is present in em_text_change(); attempt the published reproduction steps and verify that the malformed ematch is rejected with -EINVAL rather than proceeding to module autoload.

Typical attack path

  1. Obtain CAP_NET_ADMIN in a target network namespace
  2. Create a clsact qdisc on an interface
  3. Add a basic filter with a text ematch using a 16-byte non-NUL-terminated algo string and pattern_len >= 1
  4. Trigger the -ENOENT failure path that invokes modprobe with leaked kernel memory in the module name

How to detect it

Review kernel audit logs and netlink traces for em_text_change calls that fail with -ENOENT, followed immediately by modprobe invocations whose argument begins with ts_ and contains non-printable or over-length strings; inspect usermode-helper command lines for unexpected data.

  • request_module.*ts_
  • em_text_change
  • textsearch_prepare

What your security team should do

  • Prioritize kernel updates on any system exposing netlink or tc interfaces to untrusted users
  • Limit use of CAP_NET_ADMIN to the smallest possible set of processes and namespaces
  • Audit netlink traffic involving TCA_EMATCH_TREE and em_text attributes for anomalous algo lengths

The record

In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a ("net/sched: fix potential stack infoleak in em_text_dump()"), which zero-initialised the dump-side struct. Sashiko pointed at a pre-existing bug that exposed the change-side input-validation gap open. em_text_change() casts the raw netlink attribute payload to struct tcf_em_text and passes conf->algo, a 16-byte array with no enforced NUL terminator, to textsearch_prepare(). On the TS_AUTOLOAD retry textsearch_prepare() calls request_module("ts_%s", algo); vsnprintf() walks %s until it finds a NUL, so an algo[] with no NUL reads past the array into the adjacent struct fields and payload and feeds those bytes to the usermode helper command line. This is an out-of-bounds read and a kernel memory disclosure. Reject the attribute when no NUL exists within TC_EM_TEXT_ALGOSIZ bytes, matching the check xt_string has had since 3ab720881b6e. Conditions to recreate the bug: - CAP_NET_ADMIN on the target netns (namespace-local via unshare -Urn is enough) - install clsact on an interface, then add a basic filter with one text ematch whose algo[] is 16 bytes with no NUL (e.g. "A"*16) and pattern_len at least 1 - the add fails with -ENOENT and the kernel invokes modprobe with a module name made of "ts_" plus the 16 bytes and the adjacent payload

Affected packages

Ecosystem Package Introduced Fixed