In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up… (CVE-2026-98969)

The Linux kernel vulnerability (CVE-2026-98969) in the net/sched em_text module was a follow-up fix addressing a pre-existing input validation gap. The em_text_change() function casts a netlink attribute payload to a struct containing a 16-byte algo array without enforced NUL termination. When textsearch_prepare() retries with TS_AUTOLOAD, it calls request_module() with a module name constructed from the algo array. Because vsnprintf() expects a NUL-terminated string, the absence of a NUL causes it to read beyond the array into adjacent kernel memory, leading to an out-of-bounds read and kernel memory disclosure. The fix rejects attributes missing a NUL terminator within the 16-byte limit, preventing this memory disclosure vector.

This vulnerability allows a local attacker with CAP_NET_ADMIN capability in the target network namespace to cause an out-of-bounds read in kernel memory, potentially disclosing sensitive kernel memory contents. The attack requires specific conditions including installing clsact on an interface and adding a filter with a crafted ematch algorithm string. The kernel then attempts to load a module with a name derived from untrusted memory, which could leak kernel memory contents to user space. There is no indication of remote exploitation or privilege escalation beyond the required capability.

A fix has been applied to the Linux kernel that rejects em_text attributes lacking a NUL terminator within the expected 16-byte algorithm name size. Users should update to the Linux kernel version containing this fix once available. Until then, avoid adding em_text filters with unterminated algorithm names and restrict CAP_NET_ADMIN capabilities to trusted users. Patch status is not yet confirmed in the provided data — check the official Linux kernel advisories or vendor updates for the exact fixed versions and remediation guidance.