---
id: CVE-2026-98969
title: 'net/sched: em_text: reject unterminated algo before autoload'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: em_text: reject unterminated algo before autoload

  This is a follow-up to commit 9c572a83037a ("net/sched: fix potential
  stack infoleak in em_text_dump()"), …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d675c989ed2d4ba23dff615330b04371aea83534 <
    00bcc303000bac524d62eed054d77372b38ace0f
  - >-
    Linux >= d675c989ed2d4ba23dff615330b04371aea83534 <
    22182f91c6703af6e9832cffe6d22b381031cb5a
  - >-
    Linux >= d675c989ed2d4ba23dff615330b04371aea83534 <
    85e5512369d4fe6e5f2c43712d9f9e01d4ae8437
  - >-
    Linux >= d675c989ed2d4ba23dff615330b04371aea83534 <
    b627c6ba20be20334338229b4820baacb9d96826
  - >-
    Linux >= d675c989ed2d4ba23dff615330b04371aea83534 <
    c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021
  - Linux 2.6.13
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:19:42.012Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98969'
references:
  - url: 'https://git.kernel.org/stable/c/00bcc303000bac524d62eed054d77372b38ace0f'
  - url: 'https://git.kernel.org/stable/c/22182f91c6703af6e9832cffe6d22b381031cb5a'
  - url: 'https://git.kernel.org/stable/c/85e5512369d4fe6e5f2c43712d9f9e01d4ae8437'
  - url: 'https://git.kernel.org/stable/c/b627c6ba20be20334338229b4820baacb9d96826'
  - url: 'https://git.kernel.org/stable/c/c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.551Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: em_text: reject unterminated algo before autoload

This is a follow-up to commit 9c572a83037a ("net/sched: fix potential
stack infoleak in em_text_dump()"), which zero-initialised the dump-side
struct. Sashiko pointed at a pre-existing bug that exposed the change-side
input-validation gap open.

em_text_change() casts the raw netlink attribute payload to struct
tcf_em_text and passes conf->algo, a 16-byte array with no enforced NUL
terminator, to textsearch_prepare().  On the TS_AUTOLOAD retry
textsearch_prepare() calls request_module("ts_%s", algo); vsnprintf()
walks %s until it finds a NUL, so an algo[] with no NUL reads past the
array into the adjacent struct fields and payload and feeds those bytes
to the usermode helper command line.  This is an out-of-bounds read and
a kernel memory disclosure.

Reject the attribute when no NUL exists within TC_EM_TEXT_ALGOSIZ bytes,
matching the check xt_string has had since 3ab720881b6e.

Conditions to recreate the bug:
- CAP_NET_ADMIN on the target netns (namespace-local via unshare -Urn
  is enough)
- install clsact on an interface, then add a basic filter with one text
  ematch whose algo[] is 16 bytes with no NUL (e.g. "A"*16) and
  pattern_len at least 1
- the add fails with -ENOENT and the kernel invokes modprobe with a
  module name made of "ts_" plus the 16 bytes and the adjacent payload

## Affected

- `Linux >= d675c989ed2d4ba23dff615330b04371aea83534 < 00bcc303000bac524d62eed054d77372b38ace0f`
- `Linux >= d675c989ed2d4ba23dff615330b04371aea83534 < 22182f91c6703af6e9832cffe6d22b381031cb5a`
- `Linux >= d675c989ed2d4ba23dff615330b04371aea83534 < 85e5512369d4fe6e5f2c43712d9f9e01d4ae8437`
- `Linux >= d675c989ed2d4ba23dff615330b04371aea83534 < b627c6ba20be20334338229b4820baacb9d96826`
- `Linux >= d675c989ed2d4ba23dff615330b04371aea83534 < c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021`
- `Linux 2.6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.