CVE-2026-98755

tty: vcc: zero-initialize control packet in vcc_send_ctl()

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tty: vcc: zero-initialize control packet in vcc_send_ctl()

The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitialized before being sent via ldc_write(), potentially leaking kernel stack data to the LDC peer.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8868e44a56160328cd4003d95f4083f64b136e33 to before 9e2eedb3611c1a3a377105cb26af52731e826fa5Affected 8868e44a56160328cd4003d95f4083f64b136e33 to before 360111628a968ebc8e6da400b28f23ae317d4e04Affected 8868e44a56160328cd4003d95f4083f64b136e33 to before 639178bc8e77aad307a9ee5e62471c5dcc8dda67Affected 8868e44a56160328cd4003d95f4083f64b136e33 to before 4b59afc8af3143ae03e4f9b81ca66aa5a1c1ebedAffected 8868e44a56160328cd4003d95f4083f64b136e33 to before 6f1a08ef02825b440126c406ea63ef6128888e15Affected 8868e44a56160328cd4003d95f4083f64b136e33 to before 4335278d0e75395cbfaf71c84b521df56d69e936Affected 8868e44a56160328cd4003d95f4083f64b136e33 to before 399aa38af1d78001612e3130b2056ea392a355caAffected 8868e44a56160328cd4003d95f4083f64b136e33 to before 1f71f565e3585da1098ff19ca3c24687dab59185Affected
LinuxLinux	4.14Affected before 4.14Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

8868e44a56160328cd4003d95f4083f64b136e33 to before 9e2eedb3611c1a3a377105cb26af52731e826fa5Affected
8868e44a56160328cd4003d95f4083f64b136e33 to before 360111628a968ebc8e6da400b28f23ae317d4e04Affected
8868e44a56160328cd4003d95f4083f64b136e33 to before 639178bc8e77aad307a9ee5e62471c5dcc8dda67Affected
8868e44a56160328cd4003d95f4083f64b136e33 to before 4b59afc8af3143ae03e4f9b81ca66aa5a1c1ebedAffected
8868e44a56160328cd4003d95f4083f64b136e33 to before 6f1a08ef02825b440126c406ea63ef6128888e15Affected
8868e44a56160328cd4003d95f4083f64b136e33 to before 4335278d0e75395cbfaf71c84b521df56d69e936Affected
8868e44a56160328cd4003d95f4083f64b136e33 to before 399aa38af1d78001612e3130b2056ea392a355caAffected
8868e44a56160328cd4003d95f4083f64b136e33 to before 1f71f565e3585da1098ff19ca3c24687dab59185Affected

LinuxLinux

4.14Affected
before 4.14Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.