Live › vulnerability › CVE-2026-98668
Go to dashboardIn the Linux kernel IIO subsystem, the unaligned timestamp push path could send uninitialized heap memory to userspace when data is not a multiple of 8 bytes and timestamps are enabled. The fix zeroes the bounce buffer so extra bytes are cleared.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the IIO subsystem, typically hosts with industrial or embedded sensors that use IIO buffered capture with timestamps enabled. Servers and desktops without IIO sensor drivers loaded are unlikely to be exposed, though the sources do not state this explicitly.
No product ranges from the sources yet.
uname -r and compare against the kernel version that carries the upstream fix for CVE-2026-98668 (unknown from the sources).lsmod | grep -i iio; unknown from the sources whether a specific driver is required.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled. Specify __GFP_ZERO for the devm_krealloc() to ensure any extra space is cleared.
This page as .md · .json · in your agent: get_signal("CVE-2026-98668")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.