CVE-2026-98755

high

Description

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc_send_ctl() The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitialized before being sent via ldc_write(), potentially leaking kernel stack data to the LDC peer.

References

https://git.kernel.org/stable/c/6f1a08ef02825b440126c406ea63ef6128888e15

https://git.kernel.org/stable/c/4335278d0e75395cbfaf71c84b521df56d69e936

https://git.kernel.org/stable/c/399aa38af1d78001612e3130b2056ea392a355ca

https://git.kernel.org/stable/c/1f71f565e3585da1098ff19ca3c24687dab59185

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103840

Details

Source: Mitre, NVD

Published: 2026-10-18

Updated: 2026-10-19

Risk Information

CVSS v2

Base Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C

Severity: Medium

CVSS v3

Base Score: 7.1

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Severity: High