CVE-2026-98655

Received Received - Intake

Perf Text Poke Event Kernel Access Bypass

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with exclude_kernel=1 can be opened without kernel perf access. However, exclude_kernel does not suppress text-poke sideband records. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL and contains a raw kernel instruction address. An unprivileged task can therefore open and mmap a task-local software event with text_poke=1. Both opening a count-only tracepoint event and configuring UDP GRO for ESP-in-UDP cause updates to inline static calls; the observer receives the relocated addresses of the modified instructions. For a known kernel image, any such address reveals the runtime kernel text base despite KASLR. Call perf_allow_kernel() whenever attr.text_poke is set, regardless of exclude_kernel. Events that neither monitor kernel execution nor request text-poke records retain their existing permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98655

EUVD

EUVD-2026-103909

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	e17d43b93e544f5016c0251d2074c15568d5d963
Linux	Linux	e17d43b93e544f5016c0251d2074c15568d5d963
Linux	Linux	e17d43b93e544f5016c0251d2074c15568d5d963
Linux	Linux	e17d43b93e544f5016c0251d2074c15568d5d963
Linux	Linux	5.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows unprivileged users to access kernel instruction addresses through perf events. By opening a task-local software event with text_poke enabled, an attacker can receive relocated kernel instruction addresses, which can reveal the runtime kernel text base despite KASLR protections.

Detection Guidance

This vulnerability requires kernel-level inspection to detect. Check if perf events with text_poke=1 are being used by unprivileged processes. Use commands like 'perf list' to inspect available events and 'perf stat -e ...' to monitor for suspicious text poke events. Kernel logs may also show unexpected text modifications.

Impact Analysis

An attacker could exploit this to bypass kernel address space layout randomization (KASLR) and gain knowledge of kernel memory layout. This could facilitate further attacks, such as privilege escalation or information disclosure, potentially compromising system security.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to kernel-level memory access and instruction relocation. However, if exploited, it could lead to unauthorized access to kernel memory, potentially exposing sensitive data that may violate data protection regulations like GDPR or HIPAA depending on the context of use.

Mitigation Strategies

Update the Linux kernel to the latest patched version. Restrict access to perf_event_open() via kernel parameters like 'kernel.perf_event_paranoid=3'. Disable unprivileged BPF and perf event access if not required. Monitor kernel logs for unauthorized text poke events.

Hi! I’m here to help you understand CVE-2026-98655. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70