Missing initialization of resource in Linux kernel - CVE-2026-98873
Published: October 24, 2026
Vulnerability identifier: #VU157637
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98873
CWE-ID: CWE-909
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to potentially disclose sensitive information from uninitialized kernel memory.
The vulnerability exists due to missing initialization of connection-tracking expectation objects in the Linux kernel netfilter subsystem when expectation data is returned to userspace through ctnetlink. A local privileged user can obtain expectation data through ctnetlink to potentially read uninitialized kernel memory exposed in the returned data.
Affected software
Linux kernel
How to mitigate CVE-2026-98873
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/241ccd2fed9051db443aadce248fc0ab30f55e97
- https://git.kernel.org/stable/c/39cb6ff947c16a576ea68c5f272e634acdcb0085
- https://git.kernel.org/stable/c/824397af7bfe14edad374c64253dae0187ca623d
- https://git.kernel.org/stable/c/90545aa07a183887e9d72ce573c18e08f62e2c91
- https://git.kernel.org/stable/c/9c11d7ea5ff4dbe162e79f00188814ef5483c295
- https://git.kernel.org/stable/c/a39ecb856514274c80d0fac4d128dba6b266a8ed
- https://git.kernel.org/stable/c/b7f3ee925aee9f1f547d539bc03c35433c238958