Out-of-bounds Read Affecting openshift/ose-rhel-coreos-8 package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL9-OPENSHIFTOSERHELCOREOS8-21897779
- published30 Oct 2026
- disclosed23 Oct 2026
Introduced: 23 Oct 2026
NewCVE-2026-98969 (opens in a new tab)How to fix?
There is no fixed version for RHEL:9 openshift/ose-rhel-coreos-8.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openshift/ose-rhel-coreos-8 package and not the openshift/ose-rhel-coreos-8 package as distributed by RHEL.
See How to fix? for RHEL:9 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: em_text: reject unterminated algo before autoload
This is a follow-up to commit 9c572a83037a ("net/sched: fix potential stack infoleak in em_text_dump()"), which zero-initialised the dump-side struct. Sashiko pointed at a pre-existing bug that exposed the change-side input-validation gap open.
em_text_change() casts the raw netlink attribute payload to struct tcf_em_text and passes conf->algo, a 16-byte array with no enforced NUL terminator, to textsearch_prepare(). On the TS_AUTOLOAD retry textsearch_prepare() calls request_module("ts_%s", algo); vsnprintf() walks %s until it finds a NUL, so an algo[] with no NUL reads past the array into the adjacent struct fields and payload and feeds those bytes to the usermode helper command line. This is an out-of-bounds read and a kernel memory disclosure.
Reject the attribute when no NUL exists within TC_EM_TEXT_ALGOSIZ bytes, matching the check xt_string has had since 3ab720881b6e.
Conditions to recreate the bug:
- CAP_NET_ADMIN on the target netns (namespace-local via unshare -Urn is enough)
- install clsact on an interface, then add a basic filter with one text ematch whose algo[] is 16 bytes with no NUL (e.g. "A"*16) and pattern_len at least 1
- the add fails with -ENOENT and the kernel invokes modprobe with a module name made of "ts_" plus the 16 bytes and the adjacent payload
References
- https://access.redhat.com/security/cve/CVE-2026-98969
- https://git.kernel.org/stable/c/00bcc303000bac524d62eed054d77372b38ace0f
- https://git.kernel.org/stable/c/22182f91c6703af6e9832cffe6d22b381031cb5a
- https://git.kernel.org/stable/c/85e5512369d4fe6e5f2c43712d9f9e01d4ae8437
- https://git.kernel.org/stable/c/b627c6ba20be20334338229b4820baacb9d96826
- https://git.kernel.org/stable/c/c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021
- https://git.kernel.org/stable/c/64153f1dd14dabfd4e79bf506bb5b5d66f7b42eb
- https://git.kernel.org/stable/c/b4da5c85cd701066ff429727fb61b84bde8bcce2
- https://git.kernel.org/stable/c/b62fb105961b677418cbc0a0a8837a41735729ec