CVE-2026-98584: Linux Kernel Information Disclosure Vulnerability

CVE-2026-98584 Overview

CVE-2026-98584 is a kernel information disclosure flaw in the Linux kernel's net/sched subsystem. The em_text_dump() function allocates a struct tcf_em_text on the kernel stack without zero-initializing it. The strscpy() call writes the algorithm name and a NUL terminator into conf.algo[] but leaves the trailing bytes uninitialized. A subsequent nla_put_nohdr() copies the full structure into a netlink response, exposing uninitialized stack memory to userspace.

Critical Impact
Local users with permission to dump traffic control filter configurations can read uninitialized kernel stack bytes through netlink responses, potentially exposing sensitive data from prior stack frames.

Affected Products

Linux kernel versions containing commit b04202d6065c ("net/sched: replace strncpy with strscpy")
Linux kernel 7.2-rc6 (confirmed by KMSAN reporter)
Upstream mainline and stable branches prior to the fix commits

Discovery Timeline

2026-10-18 - CVE-2026-98584 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98584

Vulnerability Analysis

The flaw resides in the text ematch dump path of the Linux kernel traffic control subsystem. em_text_dump() declares a struct tcf_em_text conf on the stack as a local variable. The structure includes a fixed-size algo[] character buffer used to transport the algorithm identifier back to userspace through netlink.

strscpy() copies the algorithm name and null-terminates the result but does not pad the remaining buffer bytes with zeros. The structure's residual bytes retain whatever stack contents existed from prior function calls. nla_put_nohdr() then serializes the entire structure, including the uninitialized tail, into the netlink attribute returned to userspace.

KMSAN on Linux 7.2-rc6 flagged the issue through two code paths: the tc filter show command and raw RTM_GETTFILTER dumps. The KMSAN report identified bytes 168 through 179 of the 199-byte structure as uninitialized when copied to userspace.

Root Cause

Commit b04202d6065c ("net/sched: replace strncpy with strscpy") introduced the regression. The original strncpy() call zero-padded the destination buffer up to its declared size, which incidentally scrubbed any uninitialized bytes in conf.algo[]. strscpy() provides safer bounded copying but intentionally omits the padding behavior, exposing the uninitialized stack bytes that strncpy() had previously masked. This maps to [CWE-908] Use of Uninitialized Resource and [CWE-200] Exposure of Sensitive Information.

Attack Vector

An unprivileged local process capable of enumerating traffic control filters can trigger the leak. The attacker issues a netlink RTM_GETTFILTER request or runs tc filter show against a qdisc that has a text ematch classifier configured. The kernel responds with a netlink message containing the uninitialized stack bytes. Repeated invocations allow sampling of stack memory, which may contain pointers, credentials, or other transient secrets useful for defeating KASLR or chaining with other vulnerabilities.

No verified public exploit code is available. The reporter noted that a userspace reproducer can be provided on request. For patch-level details, see Kernel Git Commit 0b16041, Kernel Git Commit 9923e1c, and Kernel Git Commit 9c572a8.

Detection Methods for CVE-2026-98584

Indicators of Compromise

Unexpected RTM_GETTFILTER netlink dump activity originating from non-administrative processes.
Unprivileged processes executing tc filter show repeatedly against qdiscs configured with text ematch classifiers.
KMSAN kernel-infoleak reports referencing em_text_dump+0x291/0x550 and nla_put_nohdr+0x83/0x130 in debug builds.

Detection Strategies

Audit kernel versions deployed across Linux endpoints and servers to identify builds that include commit b04202d6065c but lack the three remediation commits.
Enable kernel address sanitizers (KASAN, KMSAN) in test environments to validate patch presence before promoting kernels to production.
Review netlink socket telemetry for processes making repeated AF_NETLINK requests to the NETLINK_ROUTE family targeting classifier dumps.

Monitoring Recommendations

Correlate process execution of tc, ip, or custom netlink clients with user identity and parent process context.
Baseline normal traffic control administration activity so anomalous enumeration from unexpected accounts triggers alerts.
Ingest kernel audit logs into a central data lake to retain forensic context around netlink-based information gathering.

How to Mitigate CVE-2026-98584

Immediate Actions Required

Apply the upstream kernel patches referenced below to all Linux systems running affected kernel builds.
Restrict the CAP_NET_ADMIN capability and limit access to traffic control utilities on multi-tenant and container hosts.
Rebuild and redeploy container base images and virtual machine templates with patched kernels.

Patch Information

The fix zero-initializes the struct tcf_em_text on the stack so no uninitialized bytes reach userspace through nla_put_nohdr(). Apply one of the following stable commits that matches your kernel branch: Kernel Git Commit 0b16041, Kernel Git Commit 9923e1c, or Kernel Git Commit 9c572a8. Rebuild the kernel, reboot affected hosts, and confirm the running kernel version reflects the patched build.

Workarounds

Remove or avoid configuring text ematch classifiers on production qdiscs until patches are deployed.
Deny unprivileged user namespaces where feasible to limit which accounts can create network namespaces and manipulate tc state.
Use seccomp or Landlock policies to block AF_NETLINK socket creation for workloads that do not require it.

bash

# Verify running kernel and reload after patching
uname -r
# Confirm text ematch classifier presence on qdiscs
tc filter show dev eth0
# Restrict netlink via seccomp in container runtime (example)
# docker run --security-opt seccomp=./no-netlink.json <image>