---
id: "CVE-2026-98755"
kind: "vulnerability"
aliases: ["CVE-2026-98755"]
title: "Linux kernel: uninitialized stack data sent in vcc control packets"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "sparc-ldom"]
not_affected_if: ["no-vcc-driver"]
published_at: "2026-10-18T16:17:29+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:16:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98755", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: uninitialized stack data sent in vcc control packets

The Linux kernel's vcc (virtual console concentrator) driver builds a control packet on the stack without zeroing one field, then sends it to the LDC peer. An attacker on the other end of the channel could read leftover kernel stack memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98755

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tty: vcc: zero-initialize control packet in vcc_send_ctl()

The stack-allocated struct vio_vcc pkt was partially initialized,
leaving the tag.stype_env field uninitialized before being sent via
ldc_write(), potentially leaking kernel stack data to the LDC peer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_