CVE-2026-74577

Received Received - Intake

Memory Leak in Linux Kernel MPLS Routing

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtm_tos in mpls_getroute() mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every field of the header except rtm_tos: r = nlmsg_data(nlh); r->rtm_family = AF_MPLS; r->rtm_dst_len = 20; r->rtm_src_len = 0; r->rtm_table = RT_TABLE_MAIN; r->rtm_type = RTN_UNICAST; r->rtm_scope = RT_SCOPE_UNIVERSE; r->rtm_protocol = rt->rt_protocol; r->rtm_flags = 0; struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mpls_dump_route(), which fills the very same header and does set rtm_tos = 0. Initialize rtm_tos to 0, matching mpls_dump_route(). Reproduced with KMSAN by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0 _copy_to_iter+0x36c/0x33f0 __skb_datagram_iter+0x196/0x12c0 skb_copy_datagram_iter+0x5b/0x210 netlink_recvmsg+0x37b/0xef0 ... Uninit was created at: __alloc_skb+0x8ca/0x10e0 mpls_getroute+0x1280/0x3a40 rtnetlink_rcv_msg+0x1138/0x15a0 ... Byte 19 of 64 is uninitialized (byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74577

EUVD

EUVD-2026-59642

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a kernel information leak in the Linux kernel's MPLS (Multiprotocol Label Switching) implementation. When processing an RTM_GETROUTE request, the mpls_getroute() function fails to initialize the rtm_tos field in the response structure. This leaves one byte of uninitialized heap memory in the network message sent to user space, potentially exposing sensitive kernel memory contents.

Detection Guidance

This vulnerability involves uninitialized memory in the Linux kernel's MPLS routing code. Detection requires kernel memory sanitizer tools like KMSAN or examining kernel memory dumps for uninitialized data in RTM_NEWROUTE replies. No direct network commands detect this as it is a kernel memory leak.

Impact Analysis

An attacker with local access could exploit this to leak small amounts of kernel memory to user space. While not directly exploitable for code execution, it could aid in bypassing kernel security mechanisms or information disclosure protections. The impact is limited by the small amount of leaked data (one byte per message).

Compliance Impact

This vulnerability involves an information leak of uninitialized heap memory in the Linux kernel's MPLS routing subsystem. While it does not directly impact data protection or privacy controls, it could potentially expose internal kernel memory contents to user space. This may conflict with data confidentiality requirements in standards like GDPR and HIPAA, which mandate protection against unauthorized data exposure. However, the specific impact depends on the system's configuration and whether sensitive data is processed in the affected kernel memory regions.

Mitigation Strategies

Apply the Linux kernel patch that initializes rtm_tos to 0 in mpls_getroute(). Update to a kernel version containing the fix. If patching is not immediately possible, restrict access to RTM_GETROUTE operations via netlink policies or firewall rules.

Hi! I’m here to help you understand CVE-2026-74577. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70