Heimdall Security Logo

CVE-2026-74577

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, <=6.12.*, 0, <=7.1.*, 5.15.216, 6.12.103, <95651461cf77cc6590fa08c87667717e5dcfa55d, <=5.10.*, <=6.6.*, 397fc9e5cefee0c33b86811fbddb0decb7288c52, 4.13, <295dd295e2137e10e9a5b1891d97e0f08de76f03, <2dc2fffc704a4365cae1aae078ba62223aaeff93, <ba56f88aab18d982f2a21f11390f4d8a8897782a, 6.1.183, <466b474a8deb0c93b5280c6d261e5eda6482eca7, <248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1, <=6.18.*, <4.13, <=*, <1fea5ff0eb4aa7e951bb3d380248566c473aa377, <a5cdd2407dd890f741f59b8367e4c6c101cce154, <=5.15.*, 7.1.8, 6.18.44, 6.6.151, 5.10.265, 7.2

Description

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtm_tos in mpls_getroute() mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every field of the header except rtm_tos: r = nlmsg_data(nlh); r->rtm_family = AF_MPLS; r->rtm_dst_len = 20; r->rtm_src_len = 0; r->rtm_table = RT_TABLE_MAIN; r->rtm_type = RTN_UNICAST; r->rtm_scope = RT_SCOPE_UNIVERSE; r->rtm_protocol = rt->rt_protocol; r->rtm_flags = 0; struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mpls_dump_route(), which fills the very same header and does set rtm_tos = 0. Initialize rtm_tos to 0, matching mpls_dump_route(). Reproduced with KMSAN by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0 _copy_to_iter+0x36c/0x33f0 __skb_datagram_iter+0x196/0x12c0 skb_copy_datagram_iter+0x5b/0x210 netlink_recvmsg+0x37b/0xef0 ... Uninit was created at: __alloc_skb+0x8ca/0x10e0 mpls_getroute+0x1280/0x3a40 rtnetlink_rcv_msg+0x1138/0x15a0 ... Byte 19 of 64 is uninitialized (byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)

Gravité et risque d'exploitation

CVE-2026-74577 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.17 %, ce qui la place devant 5.4 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, <=6.12.*, 0, <=7.1.*, 5.15.216, 6.12.103, <95651461cf77cc6590fa08c87667717e5dcfa55d, <=5.10.*, <=6.6.*, 397fc9e5cefee0c33b86811fbddb0decb7288c52, 4.13, <295dd295e2137e10e9a5b1891d97e0f08de76f03, <2dc2fffc704a4365cae1aae078ba62223aaeff93, <ba56f88aab18d982f2a21f11390f4d8a8897782a, 6.1.183, <466b474a8deb0c93b5280c6d261e5eda6482eca7, <248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1, <=6.18.*, <4.13, <=*, <1fea5ff0eb4aa7e951bb3d380248566c473aa377, <a5cdd2407dd890f741f59b8367e4c6c101cce154, <=5.15.*, 7.1.8, 6.18.44, 6.6.151, 5.10.265, 7.2) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE