Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-43035

net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak When building netlink messages, tc_chain_fill_node() never initializes the tcm_info field of struct tcmsg. Since the allocation is not zeroed, kernel heap memory is leaked to userspace through this 4-byte field. The fix simply zeroes tcm_info alongside the other fields that are already initialized.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e · fixed in 903c3405cfcc7700260e456ab66a5867586c9e69; From 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e · fixed in 71a3eda7e850ae844cb8993065f4e410c11a46ce; From 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e · fixed in 4ae5d23f51fb91d7d1140c6f1ba77ab0756054c3; From 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e · fixed in e35f5195cd44ff4053fbc5d71ea97681728a0099; From 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e · fixed in d6db08484c6cb3d4ad696246f9d288eceba2a078; From 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e · fixed in 906997ea3766c24fbbf9cc4bf17c047315bbd138; From 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e · fixed in 1091b3c174441a52fdbb92e2fe00338f9371a91c; From 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e · fixed in e6e3eb5ee89ac4c163d46429391c889a1bb5e404

  • Linux Linux

    4.19

  • KernelLinux

    From 4.19.0 · fixed in 5.10.253; From 5.11.0 · fixed in 5.15.203; From 5.16.0 · fixed in 6.1.168; From 6.2.0 · fixed in 6.6.134; From 6.7.0 · fixed in 6.12.81; From 6.13.0 · fixed in 6.18.22; From 6.19.0 · fixed in 6.19.12

References 8

git.kernel.org