CVE-2026-98655: Linux Kernel Information Disclosure Vulnerability

CVE-2026-98655 Overview

CVE-2026-98655 is an information disclosure vulnerability in the Linux kernel perf subsystem. The flaw allows unprivileged users to defeat Kernel Address Space Layout Randomization (KASLR) by observing PERF_RECORD_TEXT_POKE sideband records. These records expose raw kernel instruction addresses even when the perf event is opened with exclude_kernel=1. An attacker without kernel perf access can therefore learn the runtime kernel text base. The vulnerability was resolved by requiring perf_allow_kernel() whenever attr.text_poke is set, regardless of the exclude_kernel flag.

Critical Impact
An unprivileged local user can bypass KASLR on a known kernel image, enabling reliable exploitation of subsequent kernel memory corruption vulnerabilities.

Affected Products

Linux kernel versions containing the PERF_RECORD_TEXT_POKE sideband record implementation
Distributions shipping affected upstream kernel versions prior to the referenced stable commits
Systems where unprivileged users can open perf_event_open() with text_poke=1

Discovery Timeline

2026-10-18 - CVE-2026-98655 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98655

Vulnerability Analysis

The Linux kernel perf subsystem emits PERF_RECORD_TEXT_POKE sideband records whenever kernel text is patched at runtime, such as during static call updates or jump label modifications. Each record is tagged with PERF_RECORD_MISC_KERNEL and carries the raw kernel virtual address of the modified instruction.

The access control logic treated exclude_kernel=1 as sufficient to allow unprivileged users to open text-poke-enabled events. However, text-poke records bypass the exclude_kernel filter because they describe kernel self-modification rather than kernel execution samples. This design gap causes kernel addresses to leak into user-accessible mmap ring buffers.

Root Cause

The root cause is a missing capability check in the perf event attribute validation path. The kernel permitted a task-local software event with attr.text_poke=1 to be created without invoking perf_allow_kernel(). The permission model assumed exclude_kernel would suppress all kernel-tagged records, but text-poke sideband records are generated independently of the sampling filter.

Attack Vector

An unprivileged local attacker opens a task-local software perf event with text_poke=1 and exclude_kernel=1, then mmaps the event's ring buffer. The attacker triggers kernel code paths that modify inline static calls. The advisory identifies two reliable triggers: opening a count-only tracepoint event and configuring User Datagram Protocol Generic Receive Offload (UDP GRO) for ESP-in-UDP. Each static call update emits a PERF_RECORD_TEXT_POKE record containing the runtime address of the patched instruction. Comparing this address against known offsets in the kernel image reveals the KASLR base. See the upstream fix in kernel commit 677d0b5 for the implementation details.

Detection Methods for CVE-2026-98655

Indicators of Compromise

Unprivileged processes invoking perf_event_open() with attr.text_poke=1 set in the attribute structure
Unexpected mmap of perf ring buffers by non-root users followed by access to pages hosting kernel-tagged records
Correlated activity triggering static call updates, such as creation of tracepoint events or configuration changes to UDP GRO for ESP-in-UDP

Detection Strategies

Audit perf_event_open system calls using eBPF or auditd rules and flag invocations where text_poke is set by non-privileged UIDs
Monitor for processes without CAP_PERFMON or CAP_SYS_ADMIN that successfully create perf events referencing text-poke tracking
Correlate perf event creation with network stack configuration changes that would not be expected from standard user workloads

Monitoring Recommendations

Enable kernel audit rules for the perf_event_open syscall and ship logs to a centralized SIEM for review
Track changes to /proc/sys/kernel/perf_event_paranoid and alert on values that permit unprivileged perf access
Baseline normal perf usage per host and investigate deviations originating from non-administrative accounts

How to Mitigate CVE-2026-98655

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as vendor-rebuilt packages are available
Set kernel.perf_event_paranoid to 3 or higher to restrict unprivileged perf_event_open() access on hosts that do not require it
Review workloads that legitimately depend on text-poke records and ensure they run under accounts holding CAP_PERFMON

Patch Information

The fix calls perf_allow_kernel() whenever attr.text_poke is set, regardless of the exclude_kernel setting. Events that do not monitor kernel execution and do not request text-poke records retain their existing permission requirements. Upstream commits are available at kernel commit 357e8a7, kernel commit 677d0b5, kernel commit 8473f44, kernel commit 8c38cb0, and kernel commit e506333.

Workarounds

Raise kernel.perf_event_paranoid to restrict perf_event_open() to privileged users until kernels can be patched
Remove CAP_PERFMON from service accounts and containers that do not require performance monitoring
Use seccomp profiles to block perf_event_open for workloads that have no legitimate need for performance counters

bash

# Restrict unprivileged perf access until the kernel patch is applied
sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid = 3' > /etc/sysctl.d/90-perf-restrict.conf