Linux Kernel: Uninit rtm_tos Leak via RTM_GETROUTE (CVE-2026-74577)
CVE-2026-74577 Published on August 15, 2026
net: mpls: initialize rtm_tos in mpls_getroute()
In the Linux kernel, the following vulnerability has been resolved:
net: mpls: initialize rtm_tos in mpls_getroute()
mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE
request by filling a struct rtmsg allocated from an skb whose data
area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every
field of the header except rtm_tos:
r = nlmsg_data(nlh);
r->rtm_family = AF_MPLS;
r->rtm_dst_len = 20;
r->rtm_src_len = 0;
r->rtm_table = RT_TABLE_MAIN;
r->rtm_type = RTN_UNICAST;
r->rtm_scope = RT_SCOPE_UNIVERSE;
r->rtm_protocol = rt->rt_protocol;
r->rtm_flags = 0;
struct rtmsg has no padding, so the one uninitialised byte rtm_tos
(offset 3) is copied straight to user space on recvmsg(), leaking a
byte of uninitialised heap memory. This is in contrast to
mpls_dump_route(), which fills the very same header and does set
rtm_tos = 0.
Initialize rtm_tos to 0, matching mpls_dump_route().
Reproduced with KMSAN by adding an MPLS route and issuing a
non-RTM_F_FIB_MATCH RTM_GETROUTE for its label:
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0
_copy_to_iter+0x36c/0x33f0
__skb_datagram_iter+0x196/0x12c0
skb_copy_datagram_iter+0x5b/0x210
netlink_recvmsg+0x37b/0xef0
...
Uninit was created at:
__alloc_skb+0x8ca/0x10e0
mpls_getroute+0x1280/0x3a40
rtnetlink_rcv_msg+0x1138/0x15a0
...
Byte 19 of 64 is uninitialized
(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)
Products Associated with CVE-2026-74577
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 397fc9e5cefee0c33b86811fbddb0decb7288c52 and below 95651461cf77cc6590fa08c87667717e5dcfa55d is affected.
- Version 397fc9e5cefee0c33b86811fbddb0decb7288c52 and below 1fea5ff0eb4aa7e951bb3d380248566c473aa377 is affected.
- Version 397fc9e5cefee0c33b86811fbddb0decb7288c52 and below a5cdd2407dd890f741f59b8367e4c6c101cce154 is affected.
- Version 397fc9e5cefee0c33b86811fbddb0decb7288c52 and below 2dc2fffc704a4365cae1aae078ba62223aaeff93 is affected.
- Version 397fc9e5cefee0c33b86811fbddb0decb7288c52 and below 295dd295e2137e10e9a5b1891d97e0f08de76f03 is affected.
- Version 4.13 is affected.
- Before 4.13 is unaffected.
- Version 6.6.151, <= 6.6.* is unaffected.
- Version 6.12.103, <= 6.12.* is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2-rc6, <= * is unaffected.