CVE-2026-98668

Received Received - Intake

IIO Buffer Uninitialized Memory Leak in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled. Specify __GFP_ZERO for the devm_krealloc() to ensure any extra space is cleared.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98668

EUVD

EUVD-2026-103922

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6
Linux	Linux	95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6
Linux	Linux	95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6
Linux	Linux	95ec3fdf2b79eaff79e78688bbc2f7dbb98d68b6
Linux	Linux	5.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the IIO (Industrial I/O) subsystem. When the function iio_push_to_buffers_with_ts_unaligned() processes data not aligned to 8 bytes with a timestamp enabled, it exposes uninitialized heap memory to userspace. The fix ensures extra space is zeroed using __GFP_ZERO in devm_krealloc().

Detection Guidance

This vulnerability affects the Linux kernel's IIO (Industrial I/O) subsystem. Detection requires checking kernel versions and verifying if the vulnerable function iio_push_to_buffers_with_ts_unaligned() is present. Use uname -a to check kernel version and grep for the function in kernel source or modules. No direct network detection commands are applicable.

Impact Analysis

If exploited, this flaw could allow attackers to read sensitive data from kernel memory, potentially exposing passwords, encryption keys, or other confidential information. Systems using affected IIO drivers with unaligned data and timestamps may be vulnerable.

Compliance Impact

The vulnerability involves uninitialized heap memory being leaked to userspace, which could potentially expose sensitive data. This may impact compliance with standards like GDPR (data protection) or HIPAA (health information privacy) if the leaked data includes personal or health-related information. However, the specific impact depends on the context of use and data processed.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If immediate patching is not possible, disable the IIO subsystem or avoid using unaligned data with timestamps in affected applications as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-98668. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70