PT-2026-51976 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-53082

Mitre

In the Linux kernel, the following vulnerability has been resolved:

net: hamradio: 6pack: fix uninit-value in sixpack receive buf

sixpack receive buf() does not properly skip bytes with TTY error flags. The while loop iterates through the flags buffer but never advances the data pointer (cp), and passes the original count (including error bytes) to sixpack decode(). This causes sixpack decode() to process bytes that should have been skipped due to TTY errors. The TTY layer does not guarantee that cp[i] holds a meaningful value when fp[i] is set, so passing those positions to sixpack decode() results in KMSAN reporting an uninit-value read.

Fix this by processing bytes one at a time, advancing cp on each iteration, and only passing valid (non-error) bytes to sixpack decode(). This matches the pattern used by slip receive buf() and mkiss receive buf() for the same purpose.

Related Identifiers

CVE-2026-53082

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53082 · Security Note
• https://git.kernel.org/stable/c/2951656b0de00153f2687f3a093890bce72b6215 · Note
• https://git.kernel.org/stable/c/987af7625ceb1ee59d70eb0abd7af11c75e45d79 · Note
• https://git.kernel.org/stable/c/578f3aba427c938fecfa0d8c83d9acb213a9b24a · Note
• https://git.kernel.org/stable/c/e9cf4018d74237d142cd66243c821d13593270f0 · Note
• https://git.kernel.org/stable/c/bf9a38803b2626b01cc769aaf13485d8650f576f · Note
• https://git.kernel.org/stable/c/d9ce2a4b679122397d7f35bad7be46913ad1ca80 · Note
• https://git.kernel.org/stable/c/1d3abf0c3ddeefc6f6d913aa129acc06fce8240a · Note
• https://git.kernel.org/stable/c/d4cceb5184538613572fb79319453f281b1eeacb · Note