CVE-2026-98935

Not scored yetLast modified Oct 23, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

The struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized kernel stack data residing in these holes may be leaked.

Zero-initialize the struct at declaration to eliminate this information leak risk.

Fixes smatch warnings: - drivers/rtc/dev.c:392 rtc_dev_ioctl() warn: check that 'alarm' doesn't leak information (struct has a hole after 'pending')

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 23, 2026
Last modified
Oct 23, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-98936In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on hardware start When (multiple)CVE-2026-98937In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested peCVE-2026-98938In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commitCVE-2026-98939In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a diCVE-2026-98948.3Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentiCVE-2026-98940In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints ThCVE-2026-989417.0In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bfCVE-2026-98942In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU ThCVE-2026-98943In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with lockinCVE-2026-989447.8In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the reCVE-2026-989457.8In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window durCVE-2026-98946In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disa
CVE-2026-98935: Unscored | Vulnix