Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98969

net/sched: em_text: reject unterminated algo before autoload

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a ("net/sched: fix potential stack infoleak in em_text_dump()"), which zero-initialised the dump-side struct. Sashiko pointed at a pre-existing bug that exposed the change-side input-validation gap open. em_text_change() casts the raw netlink attribute payload to struct tcf_em_text and passes conf->algo, a 16-byte array with no enforced NUL terminator, to textsearch_prepare(). On the TS_AUTOLOAD retry textsearch_prepare() calls request_module("ts_%s", algo); vsnprintf() walks %s until it finds a NUL, so an algo[] with no NUL reads past the array into the adjacent struct fields and payload and feeds those bytes to the usermode helper command line. This is an out-of-bounds read and a kernel memory disclosure. Reject the attribute when no NUL exists within TC_EM_TEXT_ALGOSIZ bytes, matching the check xt_string has had since 3ab720881b6e. Conditions to recreate the bug: - CAP_NET_ADMIN on the target netns (namespace-local via unshare -Urn is enough) - install clsact on an interface, then add a basic filter with one text ematch whose algo[] is 16 bytes with no NUL (e.g. "A"*16) and pattern_len at least 1 - the add fails with -ENOENT and the kernel invokes modprobe with a module name made of "ts_" plus the 16 bytes and the adjacent payload

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d675c989ed2d4ba23dff615330b04371aea83534 to < 64153f1dd14dabfd4e79bf506bb5b5d66f7b42ebaffected
  • d675c989ed2d4ba23dff615330b04371aea83534 to < b62fb105961b677418cbc0a0a8837a41735729ecaffected
  • d675c989ed2d4ba23dff615330b04371aea83534 to < b4da5c85cd701066ff429727fb61b84bde8bcce2affected
  • d675c989ed2d4ba23dff615330b04371aea83534 to < 00bcc303000bac524d62eed054d77372b38ace0faffected
  • d675c989ed2d4ba23dff615330b04371aea83534 to < 22182f91c6703af6e9832cffe6d22b381031cb5aaffected
  • d675c989ed2d4ba23dff615330b04371aea83534 to < 85e5512369d4fe6e5f2c43712d9f9e01d4ae8437affected
  • d675c989ed2d4ba23dff615330b04371aea83534 to < b627c6ba20be20334338229b4820baacb9d96826affected
  • d675c989ed2d4ba23dff615330b04371aea83534 to < c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021affected

Linux Linux

Default version status: affected

  • 2.6.13affected
  • 0 to < 2.6.13unaffected
  • 5.10.273 to ≤ 5.10.*unaffected
  • 5.15.224 to ≤ 5.15.*unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.2.11 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References