Use of Uninitialized Variable in Linux kernel - CVE-2026-98287
Published: October 7, 2026
Vulnerability identifier: #VU153743
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98287
CWE-ID: CWE-457
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to trigger reads of uninitialized packet headroom or corrupt packet-buffer state.
The vulnerability exists due to an unsafe protocol-compression undo heuristic in pppoatm_send() when transmit admission fails with protocol compression enabled. A local user can submit packets that encounter transmit admission failure to trigger reads of uninitialized packet headroom or corrupt packet-buffer state through an unbalanced skb_push() operation.
The affected protocol-compression option is SC_COMP_PROT.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98287
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/208ccc4d08b1897451e9ba01c016bf93ff107966
- https://git.kernel.org/stable/c/30992fe39e65589ed8e000425e088fa74994b811
- https://git.kernel.org/stable/c/8e66c5969acd859ba72fb0a7fa895623fc1b3769
- https://git.kernel.org/stable/c/e2f5529b0016db7d34f411408607f5cf395a542e
- https://git.kernel.org/stable/c/e6cd1bba7d113c15c00ac63671213a096fe4d686
- https://git.kernel.org/stable/c/ecc7253683a3c55caa868ce0ee530fcb0044bd3c
- https://git.kernel.org/stable/c/ffc448eb54f5ba80d4212c1e870cdb92b0f709fa