Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to view small amounts of sensitive kernel memory. This occurs because certain internal data structures were not properly cleared before being sent to user-level applications. While this does not allow an attacker to crash the system or modify data, it could potentially expose information that helps bypass other security protections.
Technical details
A kernel information leak was identified in the tcf_ife_dump() function within net/sched/act_ife.c. The 'tc_ife' structure was partially initialized using a designated initializer, leaving padding bytes uninitialized. When the nla_put() function was called to copy this structure into a netlink message for userspace, these uninitialized bytes (potentially containing sensitive kernel memory) were leaked. The fix involves using memset() to zero-initialize the entire structure, including padding, before field assignment. This was detected by KMSAN and syzbot.
Affected products
- Linux Linux Kernel Fixed in 6.1.120, 6.6.64, 6.11.11, 6.12.2, and 6.13-rc1
Timeline
- 2025-11-09: disclosed: Initial patch submitted by Ranganath V N
- 2025-12-06: advisory: NVD publication date
- 2025-12-07: patched: Stable kernel branches updated
References
- https://git.kernel.org/stable/c/2191662058443e0bcc28d11694293d8339af6dde
- https://git.kernel.org/stable/c/37f0680887c5aeba9a433fe04b35169010568bb1
- https://git.kernel.org/stable/c/5e3644ef147bf7140259dfa4cace680c9b26fe8b
- https://git.kernel.org/stable/c/918e063304f945fb93be9bb70cacea07d0b730ea
- https://git.kernel.org/stable/c/a676a296af65d33725bdf7396803180957dbd92e
- https://git.kernel.org/stable/c/c8f51dad94cbb88054e2aacc272b3ce1ed11fb1e
- https://git.kernel.org/stable/c/ce50039be49eea9b4cd8873ca6eccded1b4a130a