CVE-2026-53082

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf<br /> <br /> sixpack_receive_buf() does not properly skip bytes with TTY error flags.<br /> The while loop iterates through the flags buffer but never advances the<br /> data pointer (cp), and passes the original count (including error bytes)<br /> to sixpack_decode(). This causes sixpack_decode() to process bytes that<br /> should have been skipped due to TTY errors. The TTY layer does not<br /> guarantee that cp[i] holds a meaningful value when fp[i] is set, so<br /> passing those positions to sixpack_decode() results in KMSAN reporting<br /> an uninit-value read.<br /> <br /> Fix this by processing bytes one at a time, advancing cp on each<br /> iteration, and only passing valid (non-error) bytes to sixpack_decode().<br /> This matches the pattern used by slip_receive_buf() and<br /> mkiss_receive_buf() for the same purpose.