CVE-2026-98584 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of the Linux 7.2-rc6 kernel version should assess exposure and prioritize verification of affected systems. Additionally, security teams and vulnerability management teams should review the provided patches and assess the potential impact on their systems. Operators of systems using the Linux kernel should also review the patches and verify their systems' exposure to this vulnerability.

Why it matters

A Linux kernel vulnerability allows for a potential stack infoleak in the em_text_dump() function. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those using the Linux 7.2-rc6 kernel version.

• Potential kernel-infoleak vulnerability.
• Verification of affected systems is necessary.
• Patching is required to zero-initialize the struct tcf_em_text.

Technical summary

The em_text_dump() function in the Linux kernel allocates a struct tcf_em_text on the stack without zeroing it. The strscpy() function writes the algorithm name and a NUL terminator into conf.algo[], leaving the remaining bytes uninitialized. The nla_put_nohdr() function then copies the full struct to the netlink response, potentially leaking stack bytes. This issue was reported by KMSAN on Linux 7.2-rc6 and can be triggered via 'tc filter show' or a raw RTM_GETTFILTER dump. The leaked stack bytes may or may not carry sensitive data on actual production kernels. To mitigate this vulnerability, it is essential to review and apply the provided patches to zero-initialize the struct tcf_em_text.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those using the Linux 7.2-rc6 kernel version.

Recommended defensive actions

• Review and apply the provided patches to zero-initialize the struct tcf_em_text.
• Verify affected Linux kernel versions and assess exposure.
• Monitor for potential exploitation attempts.
• Perform a thorough review of system logs to identify potential exploitation attempts.
• Implement additional security measures such as network segmentation and access controls.
• Conduct regular security audits to ensure the integrity of the system.
• Review and update incident response plans to address potential exploitation.

Evidence notes

The issue was identified by KMSAN on Linux 7.2-rc6 and can be triggered via 'tc filter show' or a raw RTM_GETTFILTER dump. The leaked stack bytes may or may not carry sensitive data on actual production kernels.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.