---
id: "CVE-2026-98969"
kind: "vulnerability"
aliases: ["CVE-2026-98969"]
title: "Linux kernel: text ematch reads past algorithm name, leaking memory"
severity: "medium"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["containers", "infrastructure", "kernel", "linux", "self-hosted"]
not_affected_if: ["no-cap-net-admin", "no-untrusted-users"]
published_at: "2026-10-23T13:17:18+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98969", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98969", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: text ematch reads past algorithm name, leaking memory

The Linux kernel's traffic-control text classifier copies a netlink algorithm name without checking for a terminating NUL byte, so an unterminated name is read past its buffer. The bytes read are passed to a usermode helper command line, which discloses kernel memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry (unknown in these sources).
- Check whether the `em_text` module is loaded or built in with `lsmod | grep em_text` (unknown if the sources give a precise check).

## Fix

- Update the Linux kernel to a release that includes the upstream commit rejecting unterminated algo names in em_text (version unknown in these sources).

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98969
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98969

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net/sched: em_text: reject unterminated algo before autoload

This is a follow-up to commit 9c572a83037a ("net/sched: fix potential
stack infoleak in em_text_dump()"), which zero-initialised the dump-side
struct. Sashiko pointed at a pre-existing bug that exposed the change-side
input-validation gap open.

em_text_change() casts the raw netlink attribute payload to struct
tcf_em_text and passes conf->algo, a 16-byte array with no enforced NUL
terminator, to textsearch_prepare().  On the TS_AUTOLOAD retry
textsearch_prepare() calls request_module("ts_%s", algo); vsnprintf()
walks %s until it finds a NUL, so an algo[] with no NUL reads past the
array into the adjacent struct fields and payload and feeds those bytes
to the usermode helper command line.  This is an out-of-bounds read and
a kernel memory disclosure.

Reject the attribute when no NUL exists within TC_EM_TEXT_ALGOSIZ bytes,
matching the check xt_string has had since 3ab720881b6e.

Conditions to recreate the bug:
- CAP_NET_ADMIN on the target netns (namespace-local via unshare -Urn
  is enough)
- install clsact on an interface, then add a basic filter with one text
  ematch whose algo[] is 16 bytes with no NUL (e.g. "A"*16) and
  pattern_len at least 1
- the add fails with -ENOENT and the kernel invokes modprobe with a
  module name made of "ts_" plus the 16 bytes and the adjacent payload

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_