In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with… (CVE-2026-98655)

The Linux kernel's perf subsystem permitted perf events with exclude_kernel=1 to be opened without kernel perf access, but did not suppress PERF_RECORD_TEXT_POKE sideband records. These records, marked as kernel-related, contained raw kernel instruction addresses. An unprivileged user could open and mmap a task-local software event with text_poke=1, causing updates to inline static calls and receiving relocated addresses of modified instructions. This behavior leaked the runtime kernel text base address despite KASLR protections. The fix requires calling perf_allow_kernel() whenever attr.text_poke is set, ensuring proper permission checks regardless of exclude_kernel settings.

The vulnerability could allow an unprivileged user to obtain kernel text base addresses, bypassing KASLR protections. This information disclosure could aid attackers in further kernel exploitation attempts by revealing kernel memory layout details.

A fix has been implemented that enforces kernel access permissions for perf events with text_poke enabled. Users should update their Linux kernel to a version that includes this fix. No additional mitigation is required for events that do not monitor kernel execution or request text-poke records.