net: mpls: initialize rtm_tos in mpls_getroute()
Summary
| CVE | CVE-2026-74577 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-15 13:18:03 UTC |
| Updated | 2026-08-17 06:19:56 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtm_tos in mpls_getroute() mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every field of the header except rtm_tos: r = nlmsg_data(nlh); r->rtm_family = AF_MPLS; r->rtm_dst_len = 20; r->rtm_src_len = 0; r->rtm_table = RT_TABLE_MAIN; r->rtm_type = RTN_UNICAST; r->rtm_scope = RT_SCOPE_UNIVERSE; r->rtm_protocol = rt->rt_protocol; r->rtm_flags = 0; struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mpls_dump_route(), which fills the very same header and does set rtm_tos = 0. Initialize rtm_tos to 0, matching mpls_dump_route(). Reproduced with KMSAN by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0 _copy_to_iter+0x36c/0x33f0 __skb_datagram_iter+0x196/0x12c0 skb_copy_datagram_iter+0x5b/0x210 netlink_recvmsg+0x37b/0xef0 ... Uninit was created at: __alloc_skb+0x8ca/0x10e0 mpls_getroute+0x1280/0x3a40 rtnetlink_rcv_msg+0x1138/0x15a0 ... Byte 19 of 64 is uninitialized (byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos) |
Risk And Classification
EPSS: 0.001570000 probability, percentile 0.053420000 (date 2026-08-16)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 397fc9e5cefee0c33b86811fbddb0decb7288c52 95651461cf77cc6590fa08c87667717e5dcfa55d git | Not specified |
| CNA | Linux | Linux | affected 397fc9e5cefee0c33b86811fbddb0decb7288c52 1fea5ff0eb4aa7e951bb3d380248566c473aa377 git | Not specified |
| CNA | Linux | Linux | affected 397fc9e5cefee0c33b86811fbddb0decb7288c52 a5cdd2407dd890f741f59b8367e4c6c101cce154 git | Not specified |
| CNA | Linux | Linux | affected 397fc9e5cefee0c33b86811fbddb0decb7288c52 2dc2fffc704a4365cae1aae078ba62223aaeff93 git | Not specified |
| CNA | Linux | Linux | affected 397fc9e5cefee0c33b86811fbddb0decb7288c52 295dd295e2137e10e9a5b1891d97e0f08de76f03 git | Not specified |
| CNA | Linux | Linux | affected 4.13 | Not specified |
| CNA | Linux | Linux | unaffected 4.13 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.151 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.103 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.44 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.8 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/295dd295e2137e10e9a5b1891d97e0f08de76f03 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/a5cdd2407dd890f741f59b8367e4c6c101cce154 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/2dc2fffc704a4365cae1aae078ba62223aaeff93 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/95651461cf77cc6590fa08c87667717e5dcfa55d | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/1fea5ff0eb4aa7e951bb3d380248566c473aa377 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.