{"id":"CVE-2026-98584","kind":"vulnerability","aliases":["CVE-2026-98584"],"related":[],"title":"Linux kernel: traffic-control filter dump leaks uninitialised stack bytes to users","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix potential stack infoleak in em_text_dump()\n\nem_text_dump() allocates struct tcf_em_text on the stack without zeroing\nit.  strscpy() writes the algorithm name and a NUL terminator into\nconf.algo[], leaving the remaining bytes uninitialised.  nla_put_nohdr()\nthen copies the full struct to the netlink response.\n\nKMSAN on Linux 7.2-rc6 reports two kernel-infoleak splats from this path,\none triggered via \"tc filter show\" and one via a raw RTM_GETTFILTER dump:\n\n  BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x1c9/0x2620\n    nla_put_nohdr+0x83/0x130\n    em_text_dump+0x291/0x550\n  Local variable conf created at: em_text_dump+0x5d/0x550\n  Bytes 168-179 of 199 are uninitialized\n\nI am not certain whether this constitutes a real security problem in\npractice: the test was conducted in a controlled KMSAN environment and\nthe leaked stack bytes may or may not carry sensitive data on actual\nproduction kernels.  I am reporting it because KMSAN flagged it as a\nkernel-infoleak and the fix is straightforward.  I can provide a\nuserspace reproducer on request.\n\nThe original code used strncpy() which zero-pads to the destination size.\nCommit b04202d6065c (\"net/sched: replace strncpy with strscpy\") replaced\nit with strscpy(), which does not pad, creating this condition.\nZero-initialising the struct closes it.","summary":"The tc classifier text-match dump path copies a stack struct that was not zeroed, so a few uninitialised kernel stack bytes go into the netlink reply. The reporter notes the leaked bytes may not carry sensitive data on production kernels.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","networking","runtime","self-hosted"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"- `uname -r` and compare against the fixed kernel release in your distribution's advisory (unknown from these sources)\n- Check whether `tc filter show` is reachable by untrusted local users (unknown from these sources)","fix":"- Update the Linux kernel to a release that includes the fix zeroing the struct in em_text_dump() (fixed version unknown from these sources)","status":"open","published_at":"2026-10-18T16:17:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:00+00:00","updated_at":"2026-10-25T05:23:00+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:23:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the fix zeroing the struct in em_text_dump() (fixed version unknown from these sources)","reach":"local","title":"Linux kernel: traffic-control filter dump leaks uninitialised stack bytes to users","impact":"low","summary":"The tc classifier text-match dump path copies a stack struct that was not zeroed, so a few uninitialised kernel stack bytes go into the netlink reply. The reporter notes the leaked bytes may not carry sensitive data on production kernels.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted","networking"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user reads a few uninitialised kernel stack bytes","analyst_note":"Confirm the fixed kernel versions and stable backports from the NVD entry and the upstream commit referenced in the description.","how_to_check":"- `uname -r` and compare against the fixed kernel release in your distribution's advisory (unknown from these sources)\n- Check whether `tc filter show` is reachable by untrusted local users (unknown from these sources)","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Systems running a Linux kernel with the net/sched text-match (ematch) classifier path present, where local users can issue traffic-control filter dump requests. Hosts that do not use tc filters with ematch rules or restrict netlink access to privileged users have a much smaller exposure. The sources do not say which kernel versions are affected beyond the report from a development build.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000671,"input_tokens":3771,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':168C,173C,178C,188C '-179':192C '-2026':15A,18A '-98584':16A,19A '168':191C '199':194C '7.2':134C 'actual':232C 'algorithm':106C 'alloc':92C 'b04202d6065c':275C 'bug':159C 'byte':11A,50B,61B,117C,190C,223C 'carri':64B,228C 'certain':200C 'classifi':30B 'close':297C 'code':263C 'commit':274C 'condit':291C 'conduct':213C 'conf':182C 'conf.algo':113C 'constitut':203C 'control':5A,216C 'copi':36B,123C,165C 'creat':183C,289C 'cve':14A,17A 'data':66B,230C 'destin':272C 'dump':7A,34B,88C,91C,158C,177C,187C 'em':86C,89C,95C,175C,185C 'environ':218C 'filter':6A,149C 'fix':81C,250C 'flag':241C 'follow':75C 'full':125C 'gettfilt':157C 'go':51B 'host':27B 'infoleak':84C,140C,163C,247C 'initialis':294C 'iter':167C 'kernel':2A,22B,48B,69B,73C,139C,162C,234C,246C 'kernel-infoleak':138C,161C,245C 'kmsan':131C,160C,217C,240C 'leak':8A,60B,221C 'leav':114C 'linux':1A,21B,72C,133C 'linux-kernel':20B 'local':180C 'match':33B 'may':62B,224C,226C 'name':107C 'net/sched':80C,276C 'netlink':54B,129C 'network':23B 'nla':119C,170C 'nohdr':121C,172C 'note':58B 'nul':110C 'one':145C,152C 'origin':262C 'pad':269C,288C 'path':35B,144C 'potenti':82C 'practic':209C 'problem':207C 'product':68B,233C 'provid':255C 'put':120C,171C 'raw':155C 'rc6':135C 'real':205C 'remain':116C 'replac':277C,281C 'repli':55B 'report':57B,136C,237C 'reproduc':258C 'request':260C 'resolv':79C 'respons':130C 'rtm':156C 'runtim':24B 'secur':206C 'self':26B 'self-host':25B 'sensit':65B,229C 'show':150C 'size':273C 'splat':141C 'stack':10A,38B,49B,83C,99C,222C 'straightforward':252C 'strncpi':265C,278C 'strscpi':103C,280C,284C 'struct':39B,93C,126C,296C 'tc':29B,148C 'tcf':94C 'termin':111C 'test':211C 'text':32B,87C,90C,96C,176C,186C 'text-match':31B 'traffic':4A 'traffic-control':3A 'trigger':146C 'two':137C 'uniniti':196C 'uninitialis':9A,47B,118C 'use':264C 'user':13A 'userspac':257C 'variabl':181C 'via':147C,153C 'vulner':76C 'whether':201C 'without':100C 'write':104C 'x1c9/0x2620':169C 'x291/0x550':179C 'x5d/0x550':189C 'x83/0x130':174C 'zero':43B,101C,268C,293C 'zero-initialis':292C 'zero-pad':267C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the net/sched text-match (ematch) classifier path present, where local users can issue traffic-control filter dump requests. Hosts that do not use tc filters with ematch rules or restrict netlink access to privileged users have a much smaller exposure. The sources do not say which kernel versions are affected beyond the report from a development build.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98584","severity":null,"published_at":"2026-10-18T16:17:10+00:00","modified_at":"2026-10-19T10:19:19+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}