Cyber Resilience

CVE-2026-53082

Linux Kernel 2.6.12.1 – 5.10.258

Published
24 June 2026
Modified
23 July 2026
Patch / advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0011 2th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-53082 is a medium-severity Use of Uninitialized Resource (CWE-908) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-4 (System Monitoring) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf sixpack_receive_buf() does not properly skip bytes with TTY error flags. The while loop iterates through the flags buffer but never advances the data…

more

pointer (cp), and passes the original count (including error bytes) to sixpack_decode(). This causes sixpack_decode() to process bytes that should have been skipped due to TTY errors. The TTY layer does not guarantee that cp[i] holds a meaningful value when fp[i] is set, so passing those positions to sixpack_decode() results in KMSAN reporting an uninit-value read. Fix this by processing bytes one at a time, advancing cp on each iteration, and only passing valid (non-error) bytes to sixpack_decode(). This matches the pattern used by slip_receive_buf() and mkiss_receive_buf() for the same purpose.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-52792Same product: Linux Linux Kernel
CVE-2023-53525Same product: Linux Linux Kernel
CVE-2025-21891Same product: Linux Linux Kernel
CVE-2025-37887Same product: Linux Linux Kernel
CVE-2026-31626Same product: Linux Linux Kernel
CVE-2025-71113Same product: Linux Linux Kernel
CVE-2024-42283Same product: Linux Linux Kernel
CVE-2024-40926Same product: Linux Linux Kernel
CVE-2023-53351Same product: Linux Linux Kernel
CVE-2024-53155Same product: Linux Linux Kernel

Affected Assets

linux
linux kernel
2.6.12 · 2.6.12.1 — 5.10.258 · 5.11 — 5.15.209 · 5.16 — 6.1.175

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-7 Software, Firmware, and Information Integrity
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
  • SI-4 System Monitoring
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of input data (TTY flags and bytes) before further processing in sixpack_receive_buf/sixpack_decode, preventing use of uninitialized values.

preventdetect

Requires integrity verification mechanisms that would detect or block processing of invalid/uninitialized data received from TTY layer.

detect

Enables monitoring of anomalous kernel receive-path behavior that would surface uninit-value accesses or malformed 6pack frames.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC activities such as static analysis and code review directly prevent use of uninitialized resources while also addressing many other weaknesses.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance can detect uninitialized resource usage through dynamic analysis and fuzzing.

prevents

Secure development life cycle mandates initialization checks and static analysis that can catch uninitialized resource use.

prevents

Application security requirements can specify mandatory initialization of variables and resources before use.

prevents

Secure system architecture and engineering principles include defensive coding practices that prevent use of uninitialized memory or objects.

prevents

Secure coding standards directly require explicit initialization of all variables and resources, substantially mitigating CWE-908.

References