{"id":"CVE-2026-98755","kind":"vulnerability","aliases":["CVE-2026-98755"],"related":[],"title":"Linux kernel: uninitialized stack data sent in vcc control packets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: vcc: zero-initialize control packet in vcc_send_ctl()\n\nThe stack-allocated struct vio_vcc pkt was partially initialized,\nleaving the tag.stype_env field uninitialized before being sent via\nldc_write(), potentially leaking kernel stack data to the LDC peer.","summary":"The Linux kernel's vcc (virtual console concentrator) driver builds a control packet on the stack without zeroing one field, then sends it to the LDC peer. An attacker on the other end of the channel could read leftover kernel stack memory.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","sparc-ldom"],"not_affected_if":["no-vcc-driver"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:29+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:51+00:00","updated_at":"2026-10-25T05:16:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:16:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: uninitialized stack data sent in vcc control packets","impact":"low","summary":"The Linux kernel's vcc (virtual console concentrator) driver builds a control packet on the stack without zeroing one field, then sends it to the LDC peer. An attacker on the other end of the channel could read leftover kernel stack memory.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","sparc-ldom"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel stack memory leaks to the LDC peer","analyst_note":"Check the kernel.org stable commit that adds zero-initialization to vcc_send_ctl() to confirm affected and fixed kernel versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-vcc-driver"],"who_is_affected":"Affects Linux kernels running on SPARC logical domains that use the vcc driver for virtual consoles; the sources do not say which kernel versions are fixed. Systems not using this driver can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000545,"input_tokens":3339,"output_tokens":422,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98755':13A,16A 'alloc':90C 'attack':52B 'build':33B 'channel':59B 'concentr':31B 'consol':30B 'control':9A,35B,81C 'could':60B 'ctl':86C 'cve':11A,14A 'data':5A,114C 'driver':32B 'end':56B 'env':101C 'field':43B,102C 'follow':71C 'infrastructur':17B 'initi':80C,97C 'kernel':2A,20B,26B,63B,69C,112C 'ldc':49B,108C,117C 'ldom':23B 'leak':111C 'leav':98C 'leftov':62B 'linux':1A,19B,25B,68C 'linux-kernel':18B 'memori':65B 'one':42B 'packet':10A,36B,82C 'partial':96C 'peer':50B,118C 'pkt':94C 'potenti':110C 'read':61B 'resolv':75C 'send':45B,85C 'sent':6A,106C 'sparc':22B 'sparc-ldom':21B 'stack':4A,39B,64B,89C,113C 'stack-alloc':88C 'struct':91C 'tag.stype':100C 'tti':76C 'uniniti':3A,103C 'vcc':8A,28B,77C,84C,93C 'via':107C 'vio':92C 'virtual':29B 'vulner':72C 'without':40B 'write':109C 'zero':41B,79C 'zero-initi':78C","nicknames":[],"mitigations":[],"who_affected":"Affects Linux kernels running on SPARC logical domains that use the vcc driver for virtual consoles; the sources do not say which kernel versions are fixed. Systems not using this driver can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98755","severity":null,"published_at":"2026-10-18T16:17:29+00:00","modified_at":"2026-10-21T13:21:43+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}