In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in em_text_dump() em_text_dump()… (CVE-2026-98584)

The Linux kernel net/sched subsystem had a potential stack infoleak in the em_text_dump() function. The function allocated a struct tcf_em_text on the stack without zeroing it, and strscpy() wrote the algorithm name and a NUL terminator into a field, leaving the rest uninitialized. This uninitialized data was then copied in full to netlink responses via nla_put_nohdr(). KMSAN testing on Linux 7.2-rc6 flagged kernel-infoleak warnings triggered by commands like "tc filter show" and raw RTM_GETTFILTER dumps. The issue originated from a code change replacing strncpy() (which zero-pads) with strscpy() (which does not), causing the uninitialized bytes to be exposed. The vulnerability was fixed by zero-initializing the struct before use.

The vulnerability could lead to leakage of uninitialized stack memory contents in netlink responses, potentially exposing sensitive kernel stack data. However, the reporter notes uncertainty about whether this results in a real security problem in production environments, as the leak was observed in a controlled KMSAN environment. No known exploits in the wild have been reported.

A fix is available that zero-initializes the struct tcf_em_text in em_text_dump() before use, preventing uninitialized data from being leaked. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel code fix, upgrading to a kernel version including this patch is the recommended remediation.