{"id":"CVE-2026-98584","revision":"58393436c2c549198c4bcb7ff0b04436","records":[{"revision":"58393436c2c549198c4bcb7ff0b04436","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98584","aliases":[],"title":"net/sched: fix potential stack infoleak in em_text_dump()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix potential stack infoleak in em_text_dump()\n\nem_text_dump() allocates struct tcf_em_text on the stack without zeroing\nit.  strscpy() writes the algorithm name and a NUL terminator into\nconf.algo[], leaving the remaining bytes uninitialised.  nla_put_nohdr()\nthen copies the full struct to the netlink response.\n\nKMSAN on Linux 7.2-rc6 reports two kernel-infoleak splats from this path,\none triggered via \"tc filter show\" and one via a raw RTM_GETTFILTER dump:\n\n  BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x1c9/0x2620\n    nla_put_nohdr+0x83/0x130\n    em_text_dump+0x291/0x550\n  Local variable conf created at: em_text_dump+0x5d/0x550\n  Bytes 168-179 of 199 are uninitialized\n\nI am not certain whether this constitutes a real security problem in\npractice: the test was conducted in a controlled KMSAN environment and\nthe leaked stack bytes may or may not carry sensitive data on actual\nproduction kernels.  I am reporting it because KMSAN flagged it as a\nkernel-infoleak and the fix is straightforward.  I can provide a\nuserspace reproducer on request.\n\nThe original code used strncpy() which zero-pads to the destination size.\nCommit b04202d6065c (\"net/sched: replace strncpy with strscpy\") replaced\nit with strscpy(), which does not pad, creating this condition.\nZero-initialising the struct closes it.","state":0,"publishedAt":"2026-10-18T15:18:57.204+00:00","modifiedAt":"2026-10-19T09:22:09.98+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/em_text.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b04202d6065cba5dfd51fb9866400b25573eac67\",\n                            \"lessThan\": \"9923e1c537f91f3530b52d4efce85f3d9c131bf8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b04202d6065cba5dfd51fb9866400b25573eac67\",\n                            \"lessThan\": \"0b160417826d22f24fc31a5b9cfae3b14aa70f76\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b04202d6065cba5dfd51fb9866400b25573eac67\",\n                            \"lessThan\": \"9c572a83037a7dcd653ba3a9cc468c16b857d0c9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/em_text.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/9923e1c537f91f3530b52d4efce85f3d9c131bf8","https://git.kernel.org/stable/c/0b160417826d22f24fc31a5b9cfae3b14aa70f76","https://git.kernel.org/stable/c/9c572a83037a7dcd653ba3a9cc468c16b857d0c9"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98584","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98584","identifiers":["CVE-2026-98584"]},"retained":false,"historicalAffected":[]}],"coverage":[]}