CVE-2026-98755: tty: vcc: zero-initialize control packet in vcc_send_ctl()
Published Oct 18, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
tty: vcc: zero-initialize control packet in vccsendctl()
The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite(), potentially leaking kernel stack data to the LDC peer.
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Zero-initialize the control packet struct vio_vcc pkt in tty: vcc, specifically in vcc_send_ctl(), before it is sent via ldc_write(), to prevent uninitialized stack data from being leaked to the LDC peer.
Event History
Oct 18, 2026
CVE Published
via MITRE·03:47 PM
Data Sourced
via MITRE·03:47 PM
Description
Data Sourced
via NVD·04:17 PM
Description