CVE-2026-98935

What it actually does

The vulnerability allows uninitialized kernel stack memory in padding bytes after the 'pending' field of struct rtc_wkalrm to be copied to userspace when the RTC_WKALRM_RD ioctl is invoked, resulting in an information disclosure of kernel memory contents.

Why it matters to the business

Attackers with local access could obtain fragments of kernel memory that may contain sensitive data such as pointers or credentials, potentially aiding further privilege escalation or other attacks on affected Linux systems; the issue is two days old with negligible exploit activity observed.

How an attack unfolds

An attacker with the ability to open /dev/rtc and issue the RTC_WKALRM_RD ioctl receives a structure containing leftover stack bytes from previous kernel operations; repeated calls or targeted timing may increase the chance of harvesting useful data.

How to fix it

Update to a Linux kernel containing the zero-initialization fix for rtc_dev_ioctl in drivers/rtc/dev.c; rebuild and reboot systems with the patched kernel version.

How to confirm the fix worked

Confirm the presence of the zero-initialization change at the declaration of struct rtc_wkalrm inside rtc_dev_ioctl; test by calling RTC_WKALRM_RD and verifying that padding bytes are consistently zeroed.

Typical attack path

1. Obtain local unprivileged access to a Linux system exposing /dev/rtc
2. Open the RTC device and invoke the RTC_WKALRM_RD ioctl
3. Inspect the returned structure for non-zero bytes in the padding region after the pending field
4. Repeat or correlate with other local activity to harvest additional kernel memory contents

How to detect it

Examine process execution logs and audit records for repeated or unusual opens of RTC character devices followed by ioctl calls with command RTC_WKALRM_RD; kernel memory dumps or user-space buffers containing non-zero padding after a pending flag may indicate prior leakage.

What your security team should do

• Prioritize kernel updates on any systems where local users can access RTC device nodes
• Review and restrict permissions on /dev/rtc where feasible
• Monitor EPSS and exploit maturity indicators as the two-day-old disclosure ages