248 lines
12 KiB
JSON
248 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-98655",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.362Z",
|
|
"datePublished": "2026-10-18T15:44:05.722Z",
|
|
"dateUpdated": "2026-10-30T12:38:27.085Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:38:27.085Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Require kernel access for text poke events\n\nPerf events with exclude_kernel=1 can be opened without kernel perf\naccess. However, exclude_kernel does not suppress text-poke sideband\nrecords. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL\nand contains a raw kernel instruction address.\n\nAn unprivileged task can therefore open and mmap a task-local software\nevent with text_poke=1. Both opening a count-only tracepoint event and\nconfiguring UDP GRO for ESP-in-UDP cause updates to inline static calls;\nthe observer receives the relocated addresses of the modified instructions.\nFor a known kernel image, any such address reveals the runtime kernel\ntext base despite KASLR.\n\nCall perf_allow_kernel() whenever attr.text_poke is set, regardless of\nexclude_kernel. Events that neither monitor kernel execution nor request\ntext-poke records retain their existing permissions."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/events/core.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "e17d43b93e544f5016c0251d2074c15568d5d963",
|
|
"lessThan": "4d8fc6290d14aa9e4c3b620fe3e5dc8ba3bea7e3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e17d43b93e544f5016c0251d2074c15568d5d963",
|
|
"lessThan": "c30886396eb1c0e9fdc4296398dea0db0ab37610",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e17d43b93e544f5016c0251d2074c15568d5d963",
|
|
"lessThan": "0e26d44b7c64b045adebcf5d614140f811f09752",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e17d43b93e544f5016c0251d2074c15568d5d963",
|
|
"lessThan": "8c38cb055f6a9651198780e4e4d5283de4039f79",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e17d43b93e544f5016c0251d2074c15568d5d963",
|
|
"lessThan": "8473f44db9f710ea6f8cafb22f2e3ba6cb8ca9a7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e17d43b93e544f5016c0251d2074c15568d5d963",
|
|
"lessThan": "e506333d1b9f42f1e402acebf1283af3c44a3809",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e17d43b93e544f5016c0251d2074c15568d5d963",
|
|
"lessThan": "677d0b51ac1a0db55d768c4c6399210b3de0795b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e17d43b93e544f5016c0251d2074c15568d5d963",
|
|
"lessThan": "357e8a77a501d96c9517f01f4a211eed5e9c9184",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/events/core.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.9",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.9",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.273",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.224",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.113",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.56",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.10",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.9",
|
|
"versionEndExcluding": "5.10.273"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.9",
|
|
"versionEndExcluding": "5.15.224"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.9",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.9",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.9",
|
|
"versionEndExcluding": "6.12.113"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.9",
|
|
"versionEndExcluding": "6.18.56"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.9",
|
|
"versionEndExcluding": "7.2.10"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.9",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4d8fc6290d14aa9e4c3b620fe3e5dc8ba3bea7e3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c30886396eb1c0e9fdc4296398dea0db0ab37610"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0e26d44b7c64b045adebcf5d614140f811f09752"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8c38cb055f6a9651198780e4e4d5283de4039f79"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8473f44db9f710ea6f8cafb22f2e3ba6cb8ca9a7"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e506333d1b9f42f1e402acebf1283af3c44a3809"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/677d0b51ac1a0db55d768c4c6399210b3de0795b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/357e8a77a501d96c9517f01f4a211eed5e9c9184"
|
|
}
|
|
],
|
|
"title": "perf: Require kernel access for text poke events",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |