CVE-2026-53082: net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
In the Linux kernel, the following vulnerability has been resolved:
net: hamradio: 6pack: fix uninit-value in sixpackreceivebuf
sixpackreceivebuf() does not properly skip bytes with TTY error flags. The while loop iterates through the flags buffer but never advances the data pointer (cp), and passes the original count (including error bytes) to sixpackdecode(). This causes sixpackdecode() to process bytes that should have been skipped due to TTY errors. The TTY layer does not guarantee that cp[i] holds a meaningful value when fp[i] is set, so passing those positions to sixpackdecode() results in KMSAN reporting an uninit-value read.
Fix this by processing bytes one at a time, advancing cp on each iteration, and only passing valid (non-error) bytes to sixpackdecode(). This matches the pattern used by slipreceivebuf() and mkissreceivebuf() for the same purpose.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53082?
The severity of CVE-2026-53082 is medium with a score of 5.5.
How do I fix CVE-2026-53082?
To fix CVE-2026-53082, update your Linux kernel to the latest version where this vulnerability has been patched.
What impact does CVE-2026-53082 have on affected systems?
CVE-2026-53082 could potentially lead to denial of service through memory corruption due to uninitialized values.
Which Linux kernel versions are affected by CVE-2026-53082?
CVE-2026-53082 affects specific versions of the Linux kernel and related distributions, so check your current kernel version to determine if it is impacted.
Is CVE-2026-53082 related to TTY error handling?
Yes, CVE-2026-53082 is related to TTY error handling as it involves improper handling of bytes with TTY error flags in the sixpack_receive_buf function.