Live › vulnerability › CVE-2026-98935
Go to dashboardThe Linux kernel's RTC device ioctl returned a struct with padding holes that could contain uninitialized kernel stack data. The fix zero-initializes the struct so no stack bytes reach userspace.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
The struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized kernel stack data residing in these holes may be leaked.
Zero-initialize the struct at declaration to eliminate this information leak risk.
Fixes smatch warnings:
This page as .md · .json · in your agent: get_signal("CVE-2026-98935")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.