OSV-2026-1437 Use-of-uninitialized-value in processHandshakeTLSBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=576341612 Crash type: Use-of-uninitialized-value Crash state: processHandshakeTLSBlock ndpisearchtlstcpinternal ndpidetectionprocesspacket...

ndpi:fuzz_ndpi_reader_nalloc: Use-of-uninitialized-value in processHandshakeTLSBlock

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5685346470526976 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireadernalloc Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

OSV-2026-1429 Use-of-uninitialized-value in nlohmann::json_abi_v3_12_0::detail::binary_reader<nlohmann::json_abi_v3_12_0::ba

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=575915982 Crash type: Use-of-uninitialized-value Crash state: nlohmann::jsonabiv3120::detail::binaryreadernlohmann::jsonabiv3120::ba nlohmann::jsonabiv3120::detail::binaryreadernlohmann::jsonabiv3120::ba...

json:parse_bson_fuzzer: Use-of-uninitialized-value in nlohmann::json_abi_v3_12_0::detail::binary_reader<nlohmann::json_abi_v3_12_0::ba

Project: https://github.com/nlohmann/json.git Detailed Report: https://oss-fuzz.com/testcase?key=5520518678380544 Project: json Fuzzing Engine: libFuzzer Fuzz Target: parsebsonfuzzer Job Type: libfuzzermsanjson Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Linux Distros Unpatched Vulnerability : CVE-2026-98438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, a...

UBUNTU-CVE-2026-98438

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

SUSE CVE-2026-98438

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

DEBIAN-CVE-2026-98438

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

CVE-2026-98438

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

CVE-2026-98438

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

CVE-2026-98438 mptcp: options: fix uninit-value in mptcp_write_data_fin

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

CVE-2026-98438

The Linux kernel contains a vulnerability in the mptcp options where an uninitialized value was used in mptcp_write_data_fin. Specifically, when sending a DATA_FIN without data, the system fails to properly initialize the csum field and other fields in the ext_copy structure, as these are no long...

CVE-2026-98438 mptcp: options: fix uninit-value in mptcp_write_data_fin

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

EUVD-2026-103677

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

CVE-2026-98438: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

curl:curl_fuzzer_proto_multi: Use-of-uninitialized-value in cf_socket_send

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5434019412770816 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerprotomulti Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: hsr: Fixed uninit-value access in fillframeinfo Syzbot reports the following uninit-value access problems. ===================================================== BUG: KMSAN: uninit-value in fillframeinfo net/hsr/hsrforward.c:60...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: nci: fixed an issue where uninit-value was left uninitialized in the RF discover/activated NTF handlers. ncirfdiscoverntfpacket and ncirfintfactivatedntfpacket both parse a notification into an on-stack struct that is not...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: inetdiag: Initialize pad field in struct inetdiagreqv2 KMSAN reported uninit-value access in rawlookup 1. Diag for raw sockets uses the pad field in struct inetdiagreqv2 for the underlying protocol. This field corresponds to the...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mac80211: Only QoS data frames are tracked for admission control. For admission control, it clearly only applies to QoS data frames. Otherwise, we wouldn’t even be able to access the QoS field in the header. Syzbot reported an...