CVE-2026-98935

rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

The struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized kernel stack data residing in these holes may be leaked.

Zero-initialize the struct at declaration to eliminate this information leak risk.

Fixes smatch warnings: - drivers/rtc/dev.c:392 rtc_dev_ioctl() warn: check that 'alarm' doesn't leak information (struct has a hole after 'pending')

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before f84eb9b7b0feeb267a174237d70a857042ce0158Affected 36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before a2215eb3cbbd3d9d73cc18c08e3ef53f903443cbAffected 36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before beda3c9730ad3087d01aa1d0415c40942042ec87Affected 36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before 00dc50cede96738dadc64b20e671186cddb8a58dAffected 36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before 2838d7bbb551861c25187dfb581ed6e7a56762e9Affected 36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before 0ee5c5d804d592a8328a425b9274487d393d3a05Affected
LinuxLinux	5.0Affected before 5.0Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before f84eb9b7b0feeb267a174237d70a857042ce0158Affected
36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before a2215eb3cbbd3d9d73cc18c08e3ef53f903443cbAffected
36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before beda3c9730ad3087d01aa1d0415c40942042ec87Affected
36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before 00dc50cede96738dadc64b20e671186cddb8a58dAffected
36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before 2838d7bbb551861c25187dfb581ed6e7a56762e9Affected
36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 to before 0ee5c5d804d592a8328a425b9274487d393d3a05Affected

LinuxLinux

5.0Affected
before 5.0Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.