Out-of-bounds read in Linux kernel - CVE-2026-98053
Published: September 28, 2026
Vulnerability identifier: #VU152412
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98053
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to read memory out of bounds.
The vulnerability exists due to an out-of-bounds read in avs_path_module_send_init_configs() when processing module initialization configuration IDs. A local user can supply an initialization configuration ID equal to or greater than the number of initialization configurations to read memory out of bounds.
Affected software
Linux kernel
How to mitigate CVE-2026-98053
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3