AZL-110723: CVE-2026-98935 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved:
rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak
The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data residing in these holes may be leaked.
Zero-initialize the struct at declaration to eliminate this information leak risk.
Fixes smatch warnings: - drivers/rtc/dev.c:392 rtcdevioctl() warn: check that 'alarm' doesn't leak information (struct has a hole after 'pending')
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Zero-initialize the struct rtc_wkalrm at declaration in rtc_dev_ioctl() before returning it through the RTC_WKALRM_RD ioctl, eliminating uninitialized padding-hole data leaks.