Linux Kernel CVE-2026-53082

The 6pack protocol (CWE-908: Use of Uninitialized Resource) is an AX.25-based framing protocol used over amateur radio links, implemented in drivers/net/hamradio/6pack.c. The TTY subsystem passes received data to line-discipline receive callbacks as two parallel buffers: a data buffer (cp) and a per-byte flag buffer (fp). Flags indicate TTY-layer errors (parity, framing, etc.) and the convention across all other SLIP-family drivers (slip_receive_buf, mkiss_receive_buf) is to iterate both buffers in lockstep, skipping data bytes whose corresponding flag is set. In the vulnerable code, the while loop correctly iterates fp but never advances cp, so sixpack_decode() is called with the original unfiltered data buffer and the original byte count - causing it to consume positions marked as erroneous by the TTY layer. Because the TTY layer provides no guarantee that cp[i] holds a meaningful value when fp[i] is non-zero, KMSAN (Kernel Memory Sanitizer) detects an uninit-value read at those positions. CPE data (cpe:2.3:a:linux:linux) confirms the affected product is the mainline Linux kernel.