Live › vulnerability › CVE-2026-98655
Go to dashboardLinux perf text-poke sideband records were readable without kernel perf access, even with exclude_kernel set. An unprivileged local user can observe relocated kernel instruction addresses, which reveals the kernel text base despite KASLR.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Local, unprivileged users on Linux systems running a kernel without this fix. The leak only weakens KASLR and does not by itself give code execution, so it matters most on multi-user hosts where KASLR is a defense. Systems where only trusted users have shell access are lower risk.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
perf: Require kernel access for text poke events
Perf events with exclude_kernel=1 can be opened without kernel perf access. However, exclude_kernel does not suppress text-poke sideband records. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL and contains a raw kernel instruction address.
An unprivileged task can therefore open and mmap a task-local software event with text_poke=1. Both opening a count-only tracepoint event and configuring UDP GRO for ESP-in-UDP cause updates to inline static calls; the observer receives the relocated addresses of the modified instructions. For a known kernel image, any such address reveals the runtime kernel text base despite KASLR.
Call perf_allow_kernel() whenever attr.text_poke is set, regardless of exclude_kernel. Events that neither monitor kernel execution nor request text-poke records retain their existing permissions.
This page as .md · .json · in your agent: get_signal("CVE-2026-98655")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.