{"id":"CVE-2026-98668","kind":"vulnerability","aliases":["CVE-2026-98668"],"related":[],"title":"Linux kernel IIO: unaligned buffer push leaks uninitialized heap memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Ensure bounce buffer used for unaligned case is zeroed.\n\niio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory\nto userspace if the data passed in is not a multiple of 8 bytes and the\ntimestamp is enabled. Specify __GFP_ZERO for the devm_krealloc()\nto ensure any extra space is cleared.","summary":"In the Linux kernel IIO subsystem, the unaligned timestamp push path could send uninitialized heap memory to userspace when data is not a multiple of 8 bytes and timestamps are enabled. The fix zeroes the bounce buffer so extra bytes are cleared.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iio-sensors","linux-kernel","runtime"],"not_affected_if":["no-iio-drivers"],"how_to_check":"- Run `uname -r` and compare against the kernel version that carries the upstream fix for CVE-2026-98668 (unknown from the sources).\n- Check whether IIO sensor drivers are loaded with `lsmod | grep -i iio`; unknown from the sources whether a specific driver is required.","fix":"- Update the Linux kernel to a release that includes the upstream commit adding __GFP_ZERO to the devm_krealloc() in iio_push_to_buffers_with_ts_unaligned(); the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-18T16:17:20+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:25+00:00","updated_at":"2026-10-25T05:19:25+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:19:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit adding __GFP_ZERO to the devm_krealloc() in iio_push_to_buffers_with_ts_unaligned(); the exact fixed version is unknown from the sources.","reach":"local","title":"Linux kernel IIO: unaligned buffer push leaks uninitialized heap memory","impact":"low","summary":"In the Linux kernel IIO subsystem, the unaligned timestamp push path could send uninitialized heap memory to userspace when data is not a multiple of 8 bytes and timestamps are enabled. The fix zeroes the bounce buffer so extra bytes are cleared.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","embedded","iio-sensors"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Userspace reads leaked kernel heap memory from sensor buffers","analyst_note":"Check the NVD entry and the kernel stable git commit to confirm affected and fixed kernel versions and the severity score.","how_to_check":"- Run `uname -r` and compare against the kernel version that carries the upstream fix for CVE-2026-98668 (unknown from the sources).\n- Check whether IIO sensor drivers are loaded with `lsmod | grep -i iio`; unknown from the sources whether a specific driver is required.","needs_analyst":true,"not_affected_if":["no-iio-drivers"],"who_is_affected":"Systems running a Linux kernel with the IIO subsystem, typically hosts with industrial or embedded sensors that use IIO buffered capture with timestamps enabled. Servers and desktops without IIO sensor drivers loaded are unlikely to be exposed, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000662,"input_tokens":3373,"output_tokens":650,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98668':13A,16A '8':50B,111C 'bounc':60B,80C 'buffer':5A,61B,78C,81C,91C 'byte':51B,64B,112C 'case':85C 'clear':66B,131C 'could':36B 'cve':11A,14A 'data':44B,103C 'devm':123C 'embed':17B 'enabl':55B,117C 'ensur':79C,126C 'extra':63B,128C 'fix':57B 'follow':72C 'gfp':119C 'heap':9A,39B,97C 'iio':3A,19B,29B,77C,88C 'iio-sensor':18B 'kernel':2A,23B,28B,70C 'krealloc':124C 'leak':7A,95C 'linux':1A,22B,27B,69C 'linux-kernel':21B 'memori':10A,40B,98C 'multipl':48B,109C 'pass':104C 'path':35B 'push':6A,34B,89C 'resolv':76C 'runtim':24B 'send':37B 'sensor':20B 'space':129C 'specifi':118C 'subsystem':30B 'timestamp':33B,53B,115C 'ts':93C 'unalign':4A,32B,84C,94C 'uniniti':8A,38B,96C 'use':82C 'userspac':42B,100C 'vulner':73C 'zero':58B,87C,120C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the IIO subsystem, typically hosts with industrial or embedded sensors that use IIO buffered capture with timestamps enabled. Servers and desktops without IIO sensor drivers loaded are unlikely to be exposed, though the sources do not state this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98668","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98668","severity":null,"published_at":"2026-10-18T16:17:20+00:00","modified_at":"2026-10-21T13:21:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}