CVE-2026-45930
net: mctp: ensure our nlmsg responses are initialised
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mctp: ensure our nlmsg responses are initialised Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from DEVCORE Research Team working with Trend Micro Zero Day Initiative report that a RTM_GETNEIGH will return uninitalised data in the pad bytes of the ndmsg data. Ensure we're initialising the netlink data to zero, in the link, addr and neigh response messages.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
5.15
References 7
git.kernel.org
- stable/c/b37da3ac099e145bcd3be82c745a8d335772e3af
- stable/c/c4f840437e7641764de15f2de951ac8335d641f1
- stable/c/963537a26fd892f7e414a091f807b44aeee97a7d
- stable/c/976612471a9e6ead6ceffc241e4d0a1aac90b36a
- stable/c/54ed418de62a148a655262da682a050fa05f7924
- stable/c/6fb6a97c86abb8592158088afaea0eb464cf9de1
- stable/c/a6a9bc544b675d8b5180f2718ec985ad267b5cbf