{"id":"CVE-2026-98655","kind":"vulnerability","aliases":["CVE-2026-98655"],"related":[],"title":"Linux kernel: unprivileged perf text-poke events leak kernel text addresses","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Require kernel access for text poke events\n\nPerf events with exclude_kernel=1 can be opened without kernel perf\naccess. However, exclude_kernel does not suppress text-poke sideband\nrecords. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL\nand contains a raw kernel instruction address.\n\nAn unprivileged task can therefore open and mmap a task-local software\nevent with text_poke=1. Both opening a count-only tracepoint event and\nconfiguring UDP GRO for ESP-in-UDP cause updates to inline static calls;\nthe observer receives the relocated addresses of the modified instructions.\nFor a known kernel image, any such address reveals the runtime kernel\ntext base despite KASLR.\n\nCall perf_allow_kernel() whenever attr.text_poke is set, regardless of\nexclude_kernel. Events that neither monitor kernel execution nor request\ntext-poke records retain their existing permissions.","summary":"Linux perf text-poke sideband records were readable without kernel perf access, even with exclude_kernel set. An unprivileged local user can observe relocated kernel instruction addresses, which reveals the kernel text base despite KASLR.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","multi-user-hosts"],"not_affected_if":["single-user-host"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the fix 'perf: Require kernel access for text poke events' (exact version unknown from sources)","status":"open","published_at":"2026-10-18T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:36+00:00","updated_at":"2026-10-25T05:19:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:19:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the fix 'perf: Require kernel access for text poke events' (exact version unknown from sources)","reach":"local","title":"Linux kernel: unprivileged perf text-poke events leak kernel text addresses","impact":"low","summary":"Linux perf text-poke sideband records were readable without kernel perf access, even with exclude_kernel set. An unprivileged local user can observe relocated kernel instruction addresses, which reveals the kernel text base despite KASLR.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","multi-user-hosts"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user learns kernel text base, weakening KASLR","analyst_note":"Check the NVD entry or kernel.org stable commit for the fixed kernel versions and the CVSS score.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["single-user-host"],"who_is_affected":"Local, unprivileged users on Linux systems running a kernel without this fix. The leak only weakens KASLR and does not by itself give code execution, so it matters most on multi-user hosts where KASLR is a defense. Systems where only trusted users have shell access are lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000594,"input_tokens":3555,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98655':15A,18A '1':85C,139C 'access':38B,75C,92C 'address':12A,53B,121C,168C,180C 'allow':191C 'attr.text':194C 'base':59B,186C 'call':162C,189C 'caus':157C 'configur':149C 'contain':116C 'count':144C 'count-on':143C 'cve':13A,16A 'despit':60B,187C 'esp':154C 'esp-in-udp':153C 'even':39B 'event':8A,79C,81C,135C,147C,202C 'everi':104C 'exclud':41B,83C,94C,200C 'execut':207C 'exist':216C 'follow':67C 'gro':151C 'host':25B 'howev':93C 'imag':177C 'infrastructur':19B 'inlin':160C 'instruct':52B,120C,172C 'kaslr':61B,188C 'kernel':2A,10A,20B,36B,42B,51B,57B,65C,74C,84C,90C,95C,114C,119C,176C,184C,192C,201C,206C 'known':175C 'leak':9A 'linux':1A,21B,26B,64C 'local':46B,133C 'mark':110C 'misc':113C 'mmap':129C 'modifi':171C 'monitor':205C 'multi':23B 'multi-user-host':22B 'neither':204C 'observ':49B,164C 'open':88C,127C,141C 'perf':4A,27B,37B,72C,80C,91C,105C,111C,190C 'permiss':217C 'poke':7A,30B,78C,101C,108C,138C,195C,212C 'raw':118C 'readabl':34B 'receiv':165C 'record':32B,103C,106C,112C,213C 'regardless':198C 'reloc':50B,167C 'request':209C 'requir':73C 'resolv':71C 'retain':214C 'reveal':55B,181C 'runtim':183C 'set':43B,197C 'sideband':31B,102C 'softwar':134C 'static':161C 'suppress':98C 'task':124C,132C 'task-loc':131C 'text':6A,11A,29B,58B,77C,100C,107C,137C,185C,211C 'text-pok':5A,28B,99C,210C 'therefor':126C 'tracepoint':146C 'udp':150C,156C 'unprivileg':3A,45B,123C 'updat':158C 'user':24B,47B 'vulner':68C 'whenev':193C 'without':35B,89C","nicknames":[],"mitigations":[],"who_affected":"Local, unprivileged users on Linux systems running a kernel without this fix. The leak only weakens KASLR and does not by itself give code execution, so it matters most on multi-user hosts where KASLR is a defense. Systems where only trusted users have shell access are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98655","severity":null,"published_at":"2026-10-18T16:17:18+00:00","modified_at":"2026-10-21T13:21:32+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}