SB20261022241 - Incorrect authorization in Linux kernel events

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022241

SB20261022241 - Incorrect authorization in Linux kernel events

Published: October 22, 2026

Security Bulletin ID SB20261022241
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect authorization (CVE-ID: CVE-2026-98655)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose kernel instruction addresses and bypass kernel address space layout randomization (KASLR).

The vulnerability exists due to improper authorization in the Linux kernel perf subsystem when processing events that request text-poke records with exclude_kernel=1. A local user can open and mmap a task-local software event with text_poke=1 without kernel perf access to receive raw kernel instruction addresses from text-poke records and, with a known kernel image, determine the runtime kernel text base.


Remediation

Install update from vendor's website.

References