CVE-2026-53082 net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
An attacker can read uninitialized kernel memory via the hamradio 6pack driver due to improper handling of TTY error flags.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53082?
CVE-2026-53082 is a medium-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
sixpack_receive_buf() does not properly skip bytes with TTY error flags. The while loop iterates through the flags buffer but never advances the data pointer (cp), and passes the original count (including error bytes) to sixpack_decode(). This causes sixpack_decode() to process bytes that should have been skipped due to TTY errors. The TTY layer does not guarantee that cp[i] holds a meaningful value when fp[i] is set, so passing those positions to sixpack_decode() results in KMSAN reporting an uninit-value read.
Fix this by processing bytes one at a time, advancing cp on each iteration, and only passing valid (non-error) bytes to sixpack_decode(). This matches the pattern used by slip_receive_buf() and mkiss_receive_buf() for the same purpose.
Weakness: CWE-908
Which versions are affected by CVE-2026-53082?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53082?
Apply the vendor's patch.
Is CVE-2026-53082 being exploited?
There is no known exploitation of CVE-2026-53082 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53082, DEBIAN-CVE-2026-53082, GHSA-33fq-h3x2-m8v9, ROOT-OS-DEBIAN-11-CVE-2026-53082, ROOT-OS-DEBIAN-12-CVE-2026-53082, ROOT-OS-UBUNTU-2204-CVE-2026-53082 and 2 more.