Strix
72.9K

CVE-2026-98668

UnknownEPSS 0.17%

Last modified

CVE-2026-98668 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled. Specify __GFP_ZERO for the devm_krealloc() to ensure any extra space is cleared.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled. Specify __GFP_ZERO for the devm_krealloc() to ensure any extra space is cleared.

Metrics

EPSS Probability
0.17%

6.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6, < b953b8d5e6f2d53e81faa0f3b42856cdf16fe563; >= 95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6, < b4f53cec8cc94b37601ce0bb2b272b6753beed98; >= 95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6, < b5c2f21f645e40c70fda2a4283e6f2a81e5cb9f2; >= 95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6, < b134ef820610bd873c9d59999d9824710964ce82; >= 95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6, < 3a87212b1a09a1fdd730ce5520f7b1fc0b488511; >= 95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6, < 5330036bc68d23672bfcc16c60c54701ae123083
LinuxLinux5.16

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98668?
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled. Specify __GFP_ZERO for the devm_krealloc() to ensure any extra space is cleared.
How severe is CVE-2026-98668?
Severity scoring for CVE-2026-98668 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98668?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98668?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST