Use of Uninitialized Variable in Linux kernel - CVE-2026-98482

Vulnerability identifier: #VU156782

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98482

CWE-ID: CWE-457

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker on the local network to cause the kernel to process uninitialized memory as NFC LLCP sequence data.

The vulnerability exists due to use of uninitialized memory in nfc_llcp_recv_hdlc() when processing truncated NFC LLCP PDUs without checking that the sequence byte is present. A remote attacker on the local network can send a two-byte I, RR or RNR PDU to cause the kernel to read uninitialized skb tailroom and use the byte as N(R)/N(S) sequence data.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/066205553a0106565bcede934f5721c25ebd6e4e
• https://git.kernel.org/stable/c/18f60ee882403d5b48097f5f6ae45f794e4cc643
• https://git.kernel.org/stable/c/273f9d667cde649f8de9d72b1303cc2f4b658c50
• https://git.kernel.org/stable/c/3afdbebfee2ef7e9510880868cfb482cbffe6836
• https://git.kernel.org/stable/c/51b6d73373589abb9de4d84767b0db1bc8d395d9
• https://git.kernel.org/stable/c/744e61bd06188d8bb068c26a461c252f242b05c9
• https://git.kernel.org/stable/c/810f204ef8f61f0c930cf6b3280050b3ee6a8ae7
• https://git.kernel.org/stable/c/9b4086eb67a9a3b1ce69fef1b6793827363703ce

• Use of Uninitialized Variable in Linux kernel nfc
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more