Junglewise Threat Intelligence

CVE-2026-3497: OpenSSH GSSAPI uninitialized variable use in Linux distributions

CVE-2026-3497 · Severity: high · CVSS 7.5 · Published 2026-03-12

Technologies: Debian Linux, Red Hat Enterprise Linux, OpenBSD Openssh. Vendors: Canonical, Debian, Red Hat, OpenBSD.

Executive brief

A vulnerability exists in the OpenSSH component of several major Linux distributions, including Ubuntu, Debian, and Red Hat. This issue affects the GSSAPI key exchange mechanism, which is often used for secure authentication in enterprise environments. An unauthenticated attacker can send a specially crafted network packet to crash the SSH service or potentially access sensitive memory, leading to a denial of service or information disclosure.

Technical details

The vulnerability stems from a code defect in the GSSAPI Key Exchange patch (kexgsss.c) where sshpkt_disconnect() is used instead of the terminating ssh_packet_disconnect() function. When an unexpected GSSAPI message type is received, the non-terminating error handler allows execution to fall through into code that accesses an uninitialized stack variable (recv_tok). This leads to an uninitialized pointer dereference and a subsequent call to gss_release_buffer(), which may attempt to free a garbage pointer. Depending on compiler hardening and optimization, this can result in a 100% reliable child process crash (SIGABRT/SIGSEGV) or a privilege separation boundary violation where up to 127KB of heap data is sent to the root monitor process via IPC. The vulnerability is exploitable pre-authentication if GSSAPIKeyExchange is enabled.

Affected products

  • Canonical Ubuntu Linux 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10
  • Red Hat Enterprise Linux 8, 9, 10
  • Debian Debian Linux 11.0
  • Various Linux Distributions OpenSSH (GSSAPI Patch) Impacted by distribution-specific patches

Timeline

  • 2026-03-12: disclosed: Initial disclosure by Canonical and Jeremy Brown
  • 2026-03-12: advisory: Ubuntu published USN-8090-1 and USN-8090-2
  • 2026-03-12: patched: Fixes released for Ubuntu 20.04, 22.04, 24.04, and 25.10
  • 2026-03-12: other: CVE-2026-3497 assigned

References

Related threats