CVE-2026-72441
Received Received - Intake

Kernel-infoleak in Linux kernel IEEE 802.15.4 stack

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg() KMSAN reported a kernel-infoleak in move_addr_to_user(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:131 [inline] BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:205 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26 instrument_copy_to_user include/linux/instrumented.h:131 [inline] _inline_copy_to_user include/linux/uaccess.h:205 [inline] _copy_to_user+0xcc/0x120 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:236 [inline] move_addr_to_user+0x2e7/0x440 net/socket.c:302 ____sys_recvmsg+0x232/0x610 net/socket.c:2925 ... Uninit was stored to memory at: ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline] dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739 The issue occurs because the `pan_id` field of `struct ieee802154_addr` is left uninitialized when the address mode is `IEEE802154_ADDR_NONE`. The execution flow is as follows: 1. `__ieee802154_rx_handle_packet()` declares a local `struct ieee802154_hdr hdr` on the stack. 2. `ieee802154_hdr_pull()` calls `ieee802154_hdr_get_addr()` to parse the source and destination addresses into this structure. 3. If the address mode is `IEEE802154_ADDR_NONE`, `ieee802154_hdr_get_addr()` previously only set the `mode` field, leaving the `pan_id` field containing uninitialized stack memory. 4. This uninitialized `pan_id` is later copied into a `struct sockaddr_ieee802154` in `dgram_recvmsg()` via `ieee802154_addr_to_sa()`. 5. Finally, `move_addr_to_user()` copies the socket address structure to user space, leaking the uninitialized bytes. Fix this by using `memset` to zero out the address structure in `ieee802154_hdr_get_addr()` when the mode is `IEEE802154_ADDR_NONE`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72441
EUVD
EUVD-2026-59340

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a kernel information leak vulnerability in the Linux ieee802154 subsystem. When an address mode is set to IEEE802154_ADDR_NONE, the pan_id field in the address structure is left uninitialized. This uninitialized memory is later copied to user space, potentially exposing sensitive kernel data.

Detection Guidance

This vulnerability involves kernel memory leaks in the ieee802154 subsystem. Detection requires kernel debugging tools like KMSAN or manual inspection of kernel memory during ieee802154 socket operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

An attacker could exploit this to leak sensitive kernel memory contents to user space. This may reveal information about kernel addresses or other data that could aid in further attacks against the system.

Mitigation Strategies

Apply the kernel patch that initializes the pan_id field in ieee802154_addr when address mode is IEEE802154_ADDR_NONE. Update to a fixed kernel version where memset zeroes the address structure in ieee802154_hdr_get_addr().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart