Use of Uninitialized Variable in Linux kernel - CVE-2026-63966

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU138686

Use of Uninitialized Variable in Linux kernel - CVE-2026-63966

Published: July 20, 2026


Vulnerability identifier: #VU138686
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63966
CWE-ID: CWE-457
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to disclose uninitialized kernel stack memory to userspace.

The vulnerability exists due to an uninitialized stack variable in adis16550_trigger_handler() when handling triggered buffer data collection. A local user can trigger the handler and read leaked stack bytes from the resulting userspace buffer to disclose uninitialized kernel stack memory to userspace.

Bytes 28 through 31 of the scan data buffer remain uninitialized and are exposed on each trigger due to timestamp alignment.


Affected software

Linux kernel
Ubuntu
linux-ibm (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

How to mitigate CVE-2026-63966

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

External References

Related Security Bulletins