CVE-2026-46132
Memory Leak in Linux Kernel RTNL Fill VF Info
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's rtnetlink component, specifically in the function rtnl_fill_vfinfo. The function declares a struct ifla_vf_broadcast on the stack without initializing it fully. This struct has a 32-byte field, but only the first 6 bytes are overwritten with device broadcast data, leaving the remaining 26 bytes uninitialized and containing leftover kernel stack data.
When this struct is sent to userspace via a netlink message, it leaks up to 26 bytes of uninitialized kernel stack memory per virtual function (VF) per RTM_GETLINK request. This leaked data can include sensitive information such as return addresses and transient kernel data.
The vulnerability can be triggered by any unprivileged local process that can open AF_NETLINK/NETLINK_ROUTE sockets and send RTM_GETLINK requests with specific attributes, causing the kernel to expose this uninitialized stack data.
How can this vulnerability impact me? :
This vulnerability can lead to information leakage from the kernel stack to unprivileged userspace processes. The leaked data may include sensitive kernel memory contents such as return addresses and other transient data.
An attacker could exploit this to gain insights into kernel memory layout, which might aid in further attacks such as privilege escalation or bypassing security mechanisms.
Since the vulnerability is reachable by any unprivileged local process, it increases the risk of local information disclosure without requiring elevated privileges.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing if unprivileged local processes are able to send RTM_GETLINK requests with an IFLA_EXT_MASK attribute carrying RTEXT_FILTER_VF and receive kernel stack data leakage in the IFLA_VF_BROADCAST field.
A practical detection method involves using a local user process to send a NETLINK_ROUTE RTM_GETLINK request with the appropriate filter and inspecting the response for leaked uninitialized kernel stack bytes.
While specific commands are not provided in the context, the vulnerability description implies that using tools or scripts that can send RTM_GETLINK requests via netlink sockets and parse the IFLA_VF_BROADCAST data could reveal the presence of the leak.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the patch that zeroes the on-stack struct ifla_vf_broadcast before the partial memcpy operation in the rtnl_fill_vfinfo() function.
This patch matches the existing pattern used for other vf_* structs in the same function, preventing leakage of uninitialized kernel stack data.
Until the patch is applied, restricting unprivileged local users from sending RTM_GETLINK requests with IFLA_EXT_MASK carrying RTEXT_FILTER_VF can reduce the risk of exploitation.