Strix
73.2K

CVE-2026-98655

UnknownEPSS 0.18%

Last modified

CVE-2026-98655 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with exclude_kernel=1 can be opened without kernel perf access. However, exclude_kernel does not suppress text-poke sideband records. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with exclude_kernel=1 can be opened without kernel perf access. However, exclude_kernel does not suppress text-poke sideband records. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL and contains a raw kernel instruction address. An unprivileged task can therefore open and mmap a task-local software event with text_poke=1. Both opening a count-only tracepoint event and configuring UDP GRO for ESP-in-UDP cause updates to inline static calls; the observer receives the relocated addresses of the modified instructions. For a known kernel image, any such address reveals the runtime kernel text base despite KASLR. Call perf_allow_kernel() whenever attr.text_poke is set, regardless of exclude_kernel. Events that neither monitor kernel execution nor request text-poke records retain their existing permissions.

Metrics

EPSS Probability
0.18%

7.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= e17d43b93e544f5016c0251d2074c15568d5d963, < 4d8fc6290d14aa9e4c3b620fe3e5dc8ba3bea7e3; >= e17d43b93e544f5016c0251d2074c15568d5d963, < c30886396eb1c0e9fdc4296398dea0db0ab37610; >= e17d43b93e544f5016c0251d2074c15568d5d963, < 0e26d44b7c64b045adebcf5d614140f811f09752; >= e17d43b93e544f5016c0251d2074c15568d5d963, < 8c38cb055f6a9651198780e4e4d5283de4039f79; >= e17d43b93e544f5016c0251d2074c15568d5d963, < 8473f44db9f710ea6f8cafb22f2e3ba6cb8ca9a7; >= e17d43b93e544f5016c0251d2074c15568d5d963, < e506333d1b9f42f1e402acebf1283af3c44a3809; >= e17d43b93e544f5016c0251d2074c15568d5d963, < 677d0b51ac1a0db55d768c4c6399210b3de0795b; >= e17d43b93e544f5016c0251d2074c15568d5d963, < 357e8a77a501d96c9517f01f4a211eed5e9c9184
LinuxLinux5.9

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98655?
In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with exclude_kernel=1 can be opened without kernel perf access. However, exclude_kernel does not suppress text-poke sideband records. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL and contains a raw kernel instruction address. An unprivileged task can therefore open and mmap a task-local software event with text_poke=1. Both opening a count-only tracepoint event and configuring UDP GRO for ESP-in-UDP cause updates to inline static calls; the observer receives the relocated addresses of the modified instructions. For a known kernel image, any such address reveals the runtime kernel text base despite KASLR. Call perf_allow_kernel() whenever attr.text_poke is set, regardless of exclude_kernel. Events that neither monitor kernel execution nor request text-poke records retain their existing permissions.
How severe is CVE-2026-98655?
Severity scoring for CVE-2026-98655 is pending analysis. The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98655?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98655?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST