{"id":"CVE-2026-98969","kind":"vulnerability","aliases":["CVE-2026-98969"],"related":[],"title":"Linux kernel: text ematch reads past algorithm name, leaking memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: em_text: reject unterminated algo before autoload\n\nThis is a follow-up to commit 9c572a83037a (\"net/sched: fix potential\nstack infoleak in em_text_dump()\"), which zero-initialised the dump-side\nstruct. Sashiko pointed at a pre-existing bug that exposed the change-side\ninput-validation gap open.\n\nem_text_change() casts the raw netlink attribute payload to struct\ntcf_em_text and passes conf->algo, a 16-byte array with no enforced NUL\nterminator, to textsearch_prepare().  On the TS_AUTOLOAD retry\ntextsearch_prepare() calls request_module(\"ts_%s\", algo); vsnprintf()\nwalks %s until it finds a NUL, so an algo[] with no NUL reads past the\narray into the adjacent struct fields and payload and feeds those bytes\nto the usermode helper command line.  This is an out-of-bounds read and\na kernel memory disclosure.\n\nReject the attribute when no NUL exists within TC_EM_TEXT_ALGOSIZ bytes,\nmatching the check xt_string has had since 3ab720881b6e.\n\nConditions to recreate the bug:\n- CAP_NET_ADMIN on the target netns (namespace-local via unshare -Urn\n  is enough)\n- install clsact on an interface, then add a basic filter with one text\n  ematch whose algo[] is 16 bytes with no NUL (e.g. \"A\"*16) and\n  pattern_len at least 1\n- the add fails with -ENOENT and the kernel invokes modprobe with a\n  module name made of \"ts_\" plus the 16 bytes and the adjacent payload","summary":"The Linux kernel's traffic-control text classifier copies a netlink algorithm name without checking for a terminating NUL byte, so an unterminated name is read past its buffer. The bytes read are passed to a usermode helper command line, which discloses kernel memory.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","infrastructure","kernel","linux","self-hosted"],"not_affected_if":["no-cap-net-admin","no-untrusted-users"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry (unknown in these sources).\n- Check whether the `em_text` module is loaded or built in with `lsmod | grep em_text` (unknown if the sources give a precise check).","fix":"- Update the Linux kernel to a release that includes the upstream commit rejecting unterminated algo names in em_text (version unknown in these sources).","status":"open","published_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:28+00:00","updated_at":"2026-10-25T04:56:28+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T04:56:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit rejecting unterminated algo names in em_text (version unknown in these sources).","reach":"local","title":"Linux kernel: text ematch reads past algorithm name, leaking memory","impact":"low","summary":"The Linux kernel's traffic-control text classifier copies a netlink algorithm name without checking for a terminating NUL byte, so an unterminated name is read past its buffer. The bytes read are passed to a usermode helper command line, which discloses kernel memory.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","self-hosted","containers"],"confidence":0.7,"needs_auth":"yes","worst_case":"Kernel memory contents leak to a local user with network admin capability.","analyst_note":"Confirm the fixed kernel versions and stable backport commits from the NVD entry or kernel.org stable mailing list.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry (unknown in these sources).\n- Check whether the `em_text` module is loaded or built in with `lsmod | grep em_text` (unknown if the sources give a precise check).","needs_analyst":true,"not_affected_if":["no-untrusted-users","no-cap-net-admin"],"who_is_affected":"Affects Linux systems where a user can reach net/sched traffic-control configuration, which requires CAP_NET_ADMIN in the target network namespace. Namespace-local access via unshare is enough, so multi-user hosts and container workloads with that capability are the realistic exposure. Hosts where no untrusted user holds CAP_NET_ADMIN have little exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":3794,"output_tokens":623,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98969':13A,16A '1':296C '16':152C,283C,290C,316C '3ab720881b6e':245C '9c572a83037a':95C 'add':272C,298C 'adjac':196C,320C 'admin':253C 'algo':84C,150C,175C,186C,281C 'algorithm':7A,36B 'algosiz':235C 'array':154C,193C 'attribut':140C,226C 'autoload':86C,166C 'basic':274C 'bound':217C 'buffer':53B 'bug':121C,250C 'byte':44B,55B,153C,204C,236C,284C,317C 'call':170C 'cap':251C 'cast':136C 'chang':126C,135C 'change-sid':125C 'check':39B,239C 'classifi':32B 'clsact':267C 'command':63B,209C 'commit':94C 'condit':246C 'conf':149C 'contain':17B 'control':30B 'copi':33B 'cve':11A,14A 'disclos':66B 'disclosur':223C 'dump':104C,111C 'dump-sid':110C 'e.g':288C 'em':80C,102C,133C,145C,233C 'ematch':4A,279C 'enforc':157C 'enoent':301C 'enough':265C 'exist':120C,230C 'expos':123C 'fail':299C 'feed':202C 'field':198C 'filter':275C 'find':181C 'fix':97C 'follow':74C,91C 'follow-up':90C 'gap':131C 'helper':62B,208C 'host':23B 'infoleak':100C 'infrastructur':18B 'initialis':108C 'input':129C 'input-valid':128C 'instal':266C 'interfac':270C 'invok':305C 'kernel':2A,19B,26B,67B,72C,221C,304C 'leak':9A 'least':295C 'len':293C 'line':64B,210C 'linux':1A,20B,25B,71C 'local':260C 'made':311C 'match':237C 'memori':10A,68B,222C 'modprob':306C 'modul':172C,309C 'name':8A,37B,48B,310C 'namespac':259C 'namespace-loc':258C 'net':252C 'net/sched':79C,96C 'netlink':35B,139C 'netn':257C 'nul':43B,158C,183C,189C,229C,287C 'one':277C 'open':132C 'out-of-bound':214C 'pass':58B,148C 'past':6A,51B,191C 'pattern':292C 'payload':141C,200C,321C 'plus':314C 'point':115C 'potenti':98C 'pre':119C 'pre-exist':118C 'prepar':162C,169C 'raw':138C 'read':5A,50B,56B,190C,218C 'recreat':248C 'reject':82C,224C 'request':171C 'resolv':78C 'retri':167C 'sashiko':114C 'self':22B 'self-host':21B 'side':112C,127C 'sinc':244C 'stack':99C 'string':241C 'struct':113C,143C,197C 'target':256C 'tc':232C 'tcf':144C 'termin':42B,159C 'text':3A,31B,81C,103C,134C,146C,234C,278C 'textsearch':161C,168C 'traffic':29B 'traffic-control':28B 'ts':165C,173C,313C 'unshar':262C 'untermin':47B,83C 'urn':263C 'usermod':61B,207C 'valid':130C 'via':261C 'vsnprintf':176C 'vulner':75C 'walk':177C 'whose':280C 'within':231C 'without':38B 'xt':240C 'zero':107C 'zero-initialis':106C","nicknames":[],"mitigations":[],"who_affected":"Affects Linux systems where a user can reach net/sched traffic-control configuration, which requires CAP_NET_ADMIN in the target network namespace. Namespace-local access via unshare is enough, so multi-user hosts and container workloads with that capability are the realistic exposure. Hosts where no untrusted user holds CAP_NET_ADMIN have little exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98969","severity":null,"published_at":"2026-10-23T13:17:18+00:00","modified_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}