CVE-2026-3497 is a vulnerability in the OpenSSH GSSAPI delta patches applied by various Linux distributions such as Ubuntu. The issue arises when sshpkt_disconnect() is called on an error during the GSSAPI key exchange; this function does not terminate the process, allowing an attacker to send unexpected GSSAPI message types. This leads to the program continuing execution without initializing certain connection variables, which are then accessed uninitialized, causing undefined behavior. The recommended workaround is to use ssh_packet_disconnect(), which terminates the process properly. The vulnerability's impact is influenced by compiler flag hardening configurations. The upstream OpenSSH project is not affected. Red Hat advisories provide updates and fixes for their distributions.

The vulnerability can lead to undefined behavior due to access of uninitialized memory during the GSSAPI key exchange in OpenSSH patched versions. The severity is low (CVSS 2.7), and the impact depends heavily on compiler hardening flags. There are no known exploits in the wild. The issue may cause information disclosure or denial of service but does not allow privilege escalation or remote code execution as per current data.

No official patch links are provided in the input data. The recommended workaround is to replace calls to sshpkt_disconnect() with ssh_packet_disconnect(), which terminates the process and avoids use of uninitialized variables. Users should monitor vendor advisories, such as those from Red Hat, for official patches and updates. Red Hat has released errata addressing this vulnerability. Ubuntu users should check their distribution's security updates for fixes. Patch status is not yet confirmed explicitly for Ubuntu; check vendor advisories for current remediation guidance.