Live › vulnerability › CVE-2026-98755
Go to dashboardThe Linux kernel's vcc (virtual console concentrator) driver builds a control packet on the stack without zeroing one field, then sends it to the LDC peer. An attacker on the other end of the channel could read leftover kernel stack memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Affects Linux kernels running on SPARC logical domains that use the vcc driver for virtual consoles; the sources do not say which kernel versions are fixed. Systems not using this driver can skip it.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tty: vcc: zero-initialize control packet in vcc_send_ctl()
The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitialized before being sent via ldc_write(), potentially leaking kernel stack data to the LDC peer.
This page as .md · .json · in your agent: get_signal("CVE-2026-98755")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.