CVE-2026-3497 Null dereference in openssh
Attackers can trigger undefined behavior via uninitialized memory access in GSSAPI key exchange, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3497?
CVE-2026-3497 is a low-severity vulnerability in Canonical Ubuntu Linux, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.
Which versions are affected by CVE-2026-3497?
It affects 4 products.
Linux distribution packages (40)
openssh AlmaLinux:10 | All versions | 9.9p1-13.el10_1.alma.1 |
openssh-askpass AlmaLinux:10 | All versions | 9.9p1-13.el10_1.alma.1 |
openssh-clients AlmaLinux:10 | All versions | 9.9p1-13.el10_1.alma.1 |
openssh-keycat AlmaLinux:10 | All versions | 9.9p1-13.el10_1.alma.1 |
openssh-keysign AlmaLinux:10 | All versions | 9.9p1-13.el10_1.alma.1 |
openssh-server AlmaLinux:10 | All versions | 9.9p1-13.el10_1.alma.1 |
openssh AlmaLinux:8 | All versions | 8.0p1-28.el8_10 |
openssh-askpass AlmaLinux:8 | All versions | 8.0p1-28.el8_10 |
openssh-cavs AlmaLinux:8 | All versions | 8.0p1-28.el8_10 |
openssh-clients AlmaLinux:8 | All versions | 8.0p1-28.el8_10 |
openssh-keycat AlmaLinux:8 | All versions | 8.0p1-28.el8_10 |
openssh-ldap AlmaLinux:8 | All versions | 8.0p1-28.el8_10 |
openssh-server AlmaLinux:8 | All versions | 8.0p1-28.el8_10 |
pam_ssh_agent_auth AlmaLinux:8 | All versions | 0.10.3-7.28.el8_10 |
openssh AlmaLinux:9 | All versions | 8.7p1-48.el9_7.alma.1 |
openssh-askpass AlmaLinux:9 | All versions | 8.7p1-48.el9_7.alma.1 |
openssh-clients AlmaLinux:9 | All versions | 8.7p1-48.el9_7.alma.1 |
openssh-keycat AlmaLinux:9 | All versions | 8.7p1-48.el9_7.alma.1 |
openssh-server AlmaLinux:9 | All versions | 8.7p1-48.el9_7.alma.1 |
pam_ssh_agent_auth AlmaLinux:9 | All versions | 0.10.4-5.48.el9_7.alma.1 |
openssh Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-askpass Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-askpass-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-clients Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-clients-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-keycat Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-keycat-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-keysign Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-keysign-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-server Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-server-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-sk-dummy-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:9.9p1-13.el10_1 |
openssh-askpass Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-28.el8_10 |
openssh-askpass-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-28.el8_10 |
openssh-cavs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-28.el8_10 |
openssh-clients-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-28.el8_10 |
openssh-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-28.el8_10 |
openssh-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-28.el8_10 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, OpenSSH, Redhat Enterprise Linux.
How do I fix CVE-2026-3497?
Apply the vendor's patch.
Is CVE-2026-3497 being exploited?
There is no known exploitation of CVE-2026-3497 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALSA-2026:6461, ALSA-2026:6462, ALSA-2026:6463, CLSA-2026-1774366569, CLSA-2026-1774369958, CLSA-2026-1775220882 and 21 more.