CyberSecBulletin
CVE-2026-52931NVD status: Modified

Linux: Use of Uninitialized Variable

Published Updated By the CyberSecBulletin desk

CVE-2026-52931 is a critical-severity use of uninitialized variable vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 0e388af04b3958b178a1b979527f93eb46ea1fee, 1a21c055f66e78973712a4a1be2a554f1ee2e4f4, 9884c9c02d3c90e9215db3c5128f59045d20ae91 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.5% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 0e388af04b3958b178a1b979527f93eb46ea1fee or 1a21c055f66e78973712a4a1be2a554f1ee2e4f4 or 9884c9c02d3c90e9215db3c5128f59045d20ae91 or 53f931e0146ae5bdab4cba302646827d06b3794b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.142, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to, but not including, 0e388af04b3958b178a1b979527f93eb46ea1fee; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to, but not including, 1a21c055f66e78973712a4a1be2a554f1ee2e4f4; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to, but not including, 9884c9c02d3c90e9215db3c5128f59045d20ae91; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to, but not including, 53f931e0146ae5bdab4cba302646827d06b3794b; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to, but not including, ecdaa3e4d91040206afe21bc8a0d1198a0971ff3; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to, but not including, dc2ae5fbd2dadc26735092f140b246841d969a11; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to, but not including, 85397e48afe6be83ffca5ad3f4792296bfc81d3d; 33a3bb4a3345bb511f9c69c913da95d4693e2a4e up to, but not including, 6c65cf23d4c6170fcf5714c32aa64689718cb142; and 1 more ranges0e388af04b3958b178a1b979527f93eb46ea1fee, 1a21c055f66e78973712a4a1be2a554f1ee2e4f4, 9884c9c02d3c90e9215db3c5128f59045d20ae91, 53f931e0146ae5bdab4cba302646827d06b3794b, ecdaa3e4d91040206afe21bc8a0d1198a0971ff3, dc2ae5fbd2dadc26735092f140b246841d969a11
LinuxLinux Kernel4.8 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.15.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Uninitialized Variable

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

How developers prevent this class of flaw

  • Ensure that critical variables are initialized before first use.
  • Most compilers will complain about the use of uninitialized variables if warnings are turned on.
  • When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.

More Use of Uninitialized Variable vulnerabilities (CWE-457)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use of Uninitialized Variable vulnerabilities

Spotted an error? Tell us.