In the Linux kernel, the following vulnerability has been resolved:
net: hamradio: 6pack: fix uninit-value in sixpackreceivebuf
sixpackreceivebuf() does not properly skip bytes with TTY error flags. The while loop iterates through the flags buffer but never advances the data pointer (cp), and passes the original count (including error bytes) to sixpackdecode(). This causes sixpackdecode() to process bytes that should have been skipped due to TTY errors. The TTY layer does not guarantee that cp[i] holds a meaningful value when fp[i] is set, so passing those positions to sixpack_decode() results in KMSAN reporting an uninit-value read.
Fix this by processing bytes one at a time, advancing cp on each iteration, and only passing valid (non-error) bytes to sixpackdecode(). This matches the pattern used by slipreceivebuf() and mkissreceive_buf() for the same purpose.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53082.json"
}