{"id":"CVE-2026-98935","kind":"vulnerability","aliases":["CVE-2026-98935"],"related":[],"title":"Linux kernel: RTC wakeup alarm ioctl can leak stack memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak\n\nThe struct rtc_wkalrm has padding holes after the 'pending' member.\nWhen returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized\nkernel stack data residing in these holes may be leaked.\n\nZero-initialize the struct at declaration to eliminate this information\nleak risk.\n\nFixes smatch warnings:\n- drivers/rtc/dev.c:392 rtc_dev_ioctl() warn: check that 'alarm' doesn't\n  leak information (struct has a hole after 'pending')","summary":"The Linux kernel's RTC device ioctl returned a struct with padding holes that could contain uninitialized kernel stack data. The fix zero-initializes the struct so no stack bytes reach userspace.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","rtc"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:05+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:58:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: RTC wakeup alarm ioctl can leak stack memory","impact":"low","summary":"The Linux kernel's RTC device ioctl returned a struct with padding holes that could contain uninitialized kernel stack data. The fix zero-initializes the struct so no stack bytes reach userspace.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","rtc"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Uninitialized kernel stack bytes readable by local user-space processes","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000495,"input_tokens":3454,"output_tokens":299,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98935':13A,16A '392':125C 'alarm':5A,132C 'byte':51B 'check':130C 'contain':36B 'could':35B 'cve':11A,14A 'data':40B,100C 'declar':114C 'dev':65C,127C 'devic':26B 'doesn':133C 'drivers/rtc/dev.c':124C 'elimin':116C 'fix':42B,121C 'follow':59C 'hole':33B,82C,104C,140C 'inform':74C,118C,136C 'infrastructur':17B 'initi':45B,68C,110C 'ioctl':6A,27B,96C,128C 'kernel':2A,18B,23B,38B,57C,98C 'leak':8A,75C,107C,119C,135C 'linux':1A,19B,22B,56C 'may':105C 'member':86C 'memori':10A 'pad':32B,81C 'pend':85C,142C 'prevent':73C 'rd':95C 'reach':52B 'resid':101C 'resolv':63C 'return':28B,88C 'risk':120C 'rtc':3A,20B,25B,64C,70C,78C,93C,126C 'smatch':122C 'stack':9A,39B,50B,99C 'struct':30B,47B,69C,77C,112C,137C 'uniniti':37B,97C 'userspac':53B,90C 'via':91C 'vulner':60C 'wakeup':4A 'warn':123C,129C 'wkalrm':71C,79C,94C 'zero':44B,67C,109C 'zero-initi':43B,66C,108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98935","severity":null,"published_at":"2026-10-23T13:17:14+00:00","modified_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98935","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98935","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}