GHSA-C2H5-J92R-8W96
Vulnerability from github – Published: 2026-08-15 15:30 – Updated: 2026-08-15 15:30In the Linux kernel, the following vulnerability has been resolved:
net: mpls: initialize rtm_tos in mpls_getroute()
mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every field of the header except rtm_tos:
r = nlmsg_data(nlh);
r->rtm_family = AF_MPLS;
r->rtm_dst_len = 20;
r->rtm_src_len = 0;
r->rtm_table = RT_TABLE_MAIN;
r->rtm_type = RTN_UNICAST;
r->rtm_scope = RT_SCOPE_UNIVERSE;
r->rtm_protocol = rt->rt_protocol;
r->rtm_flags = 0;
struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mpls_dump_route(), which fills the very same header and does set rtm_tos = 0.
Initialize rtm_tos to 0, matching mpls_dump_route().
Reproduced with KMSAN by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label:
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0 _copy_to_iter+0x36c/0x33f0 __skb_datagram_iter+0x196/0x12c0 skb_copy_datagram_iter+0x5b/0x210 netlink_recvmsg+0x37b/0xef0 ... Uninit was created at: __alloc_skb+0x8ca/0x10e0 mpls_getroute+0x1280/0x3a40 rtnetlink_rcv_msg+0x1138/0x15a0 ... Byte 19 of 64 is uninitialized
(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)
{
"affected": [],
"aliases": [
"CVE-2026-74577"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-15T13:18:03Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: initialize rtm_tos in mpls_getroute()\n\nmpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE\nrequest by filling a struct rtmsg allocated from an skb whose data\narea is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every\nfield of the header except rtm_tos:\n\n\tr = nlmsg_data(nlh);\n\tr-\u003ertm_family\t = AF_MPLS;\n\tr-\u003ertm_dst_len\t= 20;\n\tr-\u003ertm_src_len\t= 0;\n\tr-\u003ertm_table\t= RT_TABLE_MAIN;\n\tr-\u003ertm_type\t= RTN_UNICAST;\n\tr-\u003ertm_scope\t= RT_SCOPE_UNIVERSE;\n\tr-\u003ertm_protocol = rt-\u003ert_protocol;\n\tr-\u003ertm_flags\t= 0;\n\nstruct rtmsg has no padding, so the one uninitialised byte rtm_tos\n(offset 3) is copied straight to user space on recvmsg(), leaking a\nbyte of uninitialised heap memory. This is in contrast to\nmpls_dump_route(), which fills the very same header and does set\nrtm_tos = 0.\n\nInitialize rtm_tos to 0, matching mpls_dump_route().\n\nReproduced with KMSAN by adding an MPLS route and issuing a\nnon-RTM_F_FIB_MATCH RTM_GETROUTE for its label:\n\n BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0\n _copy_to_iter+0x36c/0x33f0\n __skb_datagram_iter+0x196/0x12c0\n skb_copy_datagram_iter+0x5b/0x210\n netlink_recvmsg+0x37b/0xef0\n ...\n Uninit was created at:\n __alloc_skb+0x8ca/0x10e0\n mpls_getroute+0x1280/0x3a40\n rtnetlink_rcv_msg+0x1138/0x15a0\n ...\n Byte 19 of 64 is uninitialized\n\n(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)",
"id": "GHSA-c2h5-j92r-8w96",
"modified": "2026-08-15T15:30:37Z",
"published": "2026-08-15T15:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74577"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1fea5ff0eb4aa7e951bb3d380248566c473aa377"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/295dd295e2137e10e9a5b1891d97e0f08de76f03"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2dc2fffc704a4365cae1aae078ba62223aaeff93"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/95651461cf77cc6590fa08c87667717e5dcfa55d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a5cdd2407dd890f741f59b8367e4c6c101cce154"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.