Use of uninitialized resource in Linux kernel - CVE-2026-98668

Vulnerability identifier: #VU156998

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98668

CWE-ID: CWE-908

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information from kernel heap memory.

The vulnerability exists due to missing initialization of the bounce buffer in iio_push_to_buffers_with_ts_unaligned() when processing data whose length is not a multiple of 8 bytes with timestamps enabled. A local user can read affected IIO buffer output to obtain uninitialized kernel heap data.

Linux kernel
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1

• https://git.kernel.org/stable/c/3a87212b1a09a1fdd730ce5520f7b1fc0b488511
• https://git.kernel.org/stable/c/5330036bc68d23672bfcc16c60c54701ae123083
• https://git.kernel.org/stable/c/b134ef820610bd873c9d59999d9824710964ce82
• https://git.kernel.org/stable/c/b4f53cec8cc94b37601ce0bb2b272b6753beed98
• https://git.kernel.org/stable/c/b5c2f21f645e40c70fda2a4283e6f2a81e5cb9f2

• Use of uninitialized resource in Linux kernel iio driver
• SUSE update for the Linux Kernel