CVE-2026-98584
Received Received - Intake

Kernel Infoleak in Linux Kernel Net Sched

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in em_text_dump() em_text_dump() allocates struct tcf_em_text on the stack without zeroing it. strscpy() writes the algorithm name and a NUL terminator into conf.algo[], leaving the remaining bytes uninitialised. nla_put_nohdr() then copies the full struct to the netlink response. KMSAN on Linux 7.2-rc6 reports two kernel-infoleak splats from this path, one triggered via "tc filter show" and one via a raw RTM_GETTFILTER dump: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x1c9/0x2620 nla_put_nohdr+0x83/0x130 em_text_dump+0x291/0x550 Local variable conf created at: em_text_dump+0x5d/0x550 Bytes 168-179 of 199 are uninitialized I am not certain whether this constitutes a real security problem in practice: the test was conducted in a controlled KMSAN environment and the leaked stack bytes may or may not carry sensitive data on actual production kernels. I am reporting it because KMSAN flagged it as a kernel-infoleak and the fix is straightforward. I can provide a userspace reproducer on request. The original code used strncpy() which zero-pads to the destination size. Commit b04202d6065c ("net/sched: replace strncpy with strscpy") replaced it with strscpy(), which does not pad, creating this condition. Zero-initialising the struct closes it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98584
EUVD
EUVD-2026-103629

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux b04202d6065cba5dfd51fb9866400b25573eac67
Linux Linux b04202d6065cba5dfd51fb9866400b25573eac67
Linux Linux b04202d6065cba5dfd51fb9866400b25573eac67
Linux Linux 6.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a kernel infoleak vulnerability in the Linux kernel's traffic control (TC) subsystem. The function em_text_dump() allocates a stack variable without initializing it, then uses strscpy() to copy data into part of it. This leaves uninitialized memory in the remaining bytes, which can be copied into a netlink response and potentially leaked to userspace. The issue was introduced when strncpy() was replaced with strscpy() in a previous commit.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves a potential stack information leak in the traffic control filter subsystem. Detection requires kernel source code analysis or running a kernel with KMSAN (Kernel Memory Sanitizer) enabled. No direct commands can detect this without kernel instrumentation.

Impact Analysis

The impact is uncertain. The vulnerability may allow exposure of small amounts of uninitialized kernel memory to userspace via TC filter operations like 'tc filter show' or RTM_GETTFILTER dumps. However, the actual risk depends on whether sensitive data exists in the leaked memory regions on production systems. The reporter notes it may not pose a real security problem in practice.

Mitigation Strategies

Apply the kernel patch that initializes the struct tcf_em_text to zero before use. Update to a Linux kernel version that includes the fix for this issue. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98584. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart