Use of Uninitialized Variable in Linux kernel - CVE-2026-45865
Published: May 28, 2026
Vulnerability identifier: #VU132629
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-45865
CWE-ID: CWE-457
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to use of uninitialized memory in the mctp i2c event handler read path when handling i2c read requests to an mctp-i2c device. A local user can issue crafted i2c read operations to disclose sensitive information.
The issue was observed with certain i2c bus drivers returning a stack uninitialized byte value during reads.
How to mitigate CVE-2026-45865
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/11f83253244060b5de5eac787f61ae3f3e559d01
- https://git.kernel.org/stable/c/1eeedb310229bfee9dd4d992e5bba33fe1378a8f
- https://git.kernel.org/stable/c/2a14e91b6d76639dac70ea170f4384c1ee3cb48d
- https://git.kernel.org/stable/c/6ff2ebfef75fbc57d937d8fbe738b967edf2d331
- https://git.kernel.org/stable/c/93e01e837e105299f1c259ef71f6e1ec4fe806e3
- https://git.kernel.org/stable/c/fa9861e5c8af7651dddfa8d490aaada17ae33b6c