CVE-2026-74659
Received Received - Intake

Uninitialized Memory Exposure in Linux Kernel MRP Test Frames

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mrp: fix uninitialised bytes on the wire br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is appended with sub_tlv = skb_put(skb, sizeof(*sub_tlv)); sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR; so sub_tlv->length is never written, and the two trailing alignment bytes are appended with a bare skb_put() that does not clear them either. The neighbouring oui and sub_opt regions are explicitly zeroed, so three uninitialised bytes are left in every MRA MRP_Test frame that goes out. Put the sub-option TLV header and the alignment padding in a single skb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no payload, so the zeroed length field is already the value it should have.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74659
EUVD
EUVD-2026-64596

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves uninitialized memory being sent over the network in MRP test frames. The issue occurs when building MRP test frames where certain bytes in the frame are not cleared before transmission, potentially exposing sensitive data.

Detection Guidance

This vulnerability involves uninitialized bytes in MRP test frames sent by the Linux kernel's bridge MRP implementation. Detection requires monitoring network traffic for malformed MRP frames or analyzing kernel logs for related errors. Use tools like tcpdump to capture bridge MRP traffic and inspect for uninitialized padding bytes in MRA frames. Check kernel logs for bridge MRP-related warnings or errors.

Impact Analysis

An attacker in the local network could exploit this to capture uninitialized memory contents from network traffic, potentially revealing sensitive information like passwords or encryption keys. It may also lead to unexpected behavior in network protocols relying on MRP.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations if sensitive data is leaked due to uninitialized memory in network traffic.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for CVE-2026-74659. If immediate patching is not possible, disable MRP (Media Redundancy Protocol) on affected bridge interfaces as a temporary workaround. Monitor network traffic for signs of exploitation or misbehavior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart