CVE-2026-98655: perf: Require kernel access for text poke events
In the Linux kernel, the following vulnerability has been resolved:
perf: Require kernel access for text poke events
Perf events with excludekernel=1 can be opened without kernel perf access. However, excludekernel does not suppress text-poke sideband records. Every PERFRECORDTEXTPOKE is marked PERFRECORDMISCKERNEL and contains a raw kernel instruction address.
An unprivileged task can therefore open and mmap a task-local software event with textpoke=1. Both opening a count-only tracepoint event and configuring UDP GRO for ESP-in-UDP cause updates to inline static calls; the observer receives the relocated addresses of the modified instructions. For a known kernel image, any such address reveals the runtime kernel text base despite KASLR.
Call perfallowkernel() whenever attr.textpoke is set, regardless of excludekernel. Events that neither monitor kernel execution nor request text-poke records retain their existing permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Call perf_allow_kernel() whenever attr.text_poke is set, regardless of exclude_kernel.
Linux kernel perf events kernel access for text_poke events = required
Event History
Frequently Asked Questions
Who can exploit this issue?
An unprivileged local task that can open and mmap a task-local software perf event may exploit it when text-poke records are requested. The vulnerable behavior applies even when the event is configured with exclude_kernel=1, because that setting did not suppress text-poke sideband records.
What does an attacker need to do to disclose the kernel text base?
The attacker needs to enable text_poke=1 on a task-local software event and trigger an inline static-call update. The described triggers are opening a count-only tracepoint event or configuring UDP GRO for ESP-in-UDP; the resulting PERF_RECORD_TEXT_POKE records expose relocated kernel instruction addresses.
What is the security impact?
For a known kernel image, a disclosed relocated instruction address reveals the runtime kernel text base and defeats KASLR. The issue is an information disclosure through perf text-poke sideband records.
What changes with the fix?
The fix requires kernel perf access whenever attr.text_poke is set, irrespective of exclude_kernel. Events that do not monitor kernel execution and do not request text-poke records retain their existing permission behavior.