CVE-2026-3497: canonical ubuntu_linux Use of Uninitialized Resource

CVSS: 8.2v3.1HighModified

AliasesRHSA-2026:10714RHSA-2026:13750RHSA-2026:14924+10 more

Published 12-03-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-3497 is a high (CVSS 8.2) Use of Uninitialized Resource vulnerability in canonical ubuntu_linux. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 69.9% of scored vulnerabilities.

Overall risk

33/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.2/10

010

High · v3.1 (CVE.org)

EPSS score

1.30%

0%100%

Low · -0.88 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 12

OPENSUSE-SU-2026:10937-1 OPENSUSE-SU-2026:21044-1 RHSA-2026:5475 SUSE-SU-2026:22067-1 SUSE-SU-2026:22268-1 SUSE-SU-2026:22352-1+7 more

Timeline

12-03-2026
PublishedVulnerability first disclosed.
15-10-2026
Last modifiedVulnerability information updated.

Description

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.

CVSS metrics

8 scores · 5 sources · 2 versions

v4.02.7v3.18.2

EPSS trend

Probability

1.30%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

-0.88 pp

From 2.18% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat21 products

enterprise_linux8.0 | 9.0 | 10.0
openssh< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-13.el9_0.2 | < 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2 | < 0:8.7p1-45.el9_6.2 | < 0:8.7p1-38.el9_4.7
openssh-askpass< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-13.el9_0.2 | < 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2 | < 0:8.7p1-45.el9_6.2 | < 0:8.7p1-38.el9_4.7
openssh-askpass-debuginfo< 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1
openssh-cavs< 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10

openssh-cavs-debuginfo< 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10
openssh-clients< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-13.el9_0.2 | < 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2 | < 0:8.7p1-45.el9_6.2 | < 0:8.7p1-38.el9_4.7
openssh-clients-debuginfo< 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1
openssh-debuginfo< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-13.el9_0.2 | < 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:8.7p1-38.el9_4.7
openssh-debugsource< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-13.el9_0.2 | < 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2 | < 0:8.7p1-45.el9_6.2 | < 0:8.7p1-38.el9_4.7
openssh-keycat< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-13.el9_0.2 | < 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2 | < 0:8.7p1-45.el9_6.2 | < 0:8.7p1-38.el9_4.7
openssh-keycat-debuginfo< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-13.el9_0.2 | < 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2 | < 0:8.7p1-45.el9_6.2 | < 0:8.7p1-38.el9_4.7
openssh-keysign< 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2
openssh-keysign-debuginfo< 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2
openssh-ldap< 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10
openssh-ldap-debuginfo< 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10
openssh-server< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-13.el9_0.2 | < 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2 | < 0:8.7p1-45.el9_6.2 | < 0:8.7p1-38.el9_4.7
openssh-server-debuginfo< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-13.el9_0.2 | < 0:8.0p1-20.el8_8.3 | < 0:8.0p1-7.el8_4.1 | < 0:8.0p1-15.el8_6.4 | < 0:8.0p1-28.el8_10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:9.9p1-7.el10_0.2 | < 0:8.7p1-45.el9_6.2 | < 0:8.7p1-38.el9_4.7
openssh-sk-dummy-debuginfo< 0:8.7p1-30.el9_2.10 | < 0:8.7p1-48.el9_7 | < 0:9.9p1-13.el10_1 | < 0:8.7p1-45.el9_6.2 | < 0:8.7p1-38.el9_4.7
pam_ssh_agent_auth< 0:0.10.4-5.30.el9_2.10 | < 0:0.10.4-4.13.el9_0.5 | < 0:0.10.3-7.20.el8_8.3 | < 0:0.10.3-7.7.el8_4.2 | < 0:0.10.3-7.15.el8_6.4 | < 0:0.10.3-7.28.el8_10 | < 0:0.10.4-5.48.el9_7 | < 0:0.10.4-5.45.el9_6.1 | < 0:0.10.4-5.38.el9_4.7
pam_ssh_agent_auth-debuginfo< 0:0.10.4-5.30.el9_2.10 | < 0:0.10.4-4.13.el9_0.5 | < 0:0.10.3-7.20.el8_8.3 | < 0:0.10.3-7.7.el8_4.2 | < 0:0.10.3-7.15.el8_6.4 | < 0:0.10.3-7.28.el8_10 | < 0:0.10.4-5.48.el9_7 | < 0:0.10.4-5.45.el9_6.1 | < 0:0.10.4-5.38.el9_4.7

Show all 21

Ubuntu3 products

opensshAll versions (No fix recorded) | < 1:8.2p1-4ubuntu0.13+esm1 | < 1:8.2p1-4ubuntu0.fips.0.13.1 | < 1:8.9p1-3ubuntu0.14 | < 1:8.9p1-3ubuntu0.14+Fips1 | < 1:9.6p1-3ubuntu13.15 | < 1:9.6p1-3ubuntu13.15+Fips1 | < 1:10.0p1-5ubuntu5.1
openssh-ssh1All versions (No fix recorded)
openssh≥ 1:10.0p1-5ubuntu5, < 1:10.0p1-5ubuntu5.1 | ≥ 1:9.6p1-3ubuntu13, < 1:9.6p1-3ubuntu13.15 | ≥ 1:8.9p1-3, < 1:8.9p1-3ubuntu0.14

Debian2 products