Executive brief
A vulnerability was identified in the Linux kernel's networking component that handles IP security (IPsec) key management. Under certain conditions, the system fails to properly clear small amounts of memory before sending data over the network. This could potentially lead to the unintended disclosure of small fragments of sensitive kernel memory to local users or across the network, or cause system instability.
Technical details
An information leak vulnerability exists in the Linux kernel's net/key/af_key.c component. The PF_KEY export paths (specifically SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, and SADB_X_MIGRATE) use pfkey_sockaddr_size() to reserve 32 bytes for IPv6 addresses, but pfkey_sockaddr_fill() only initializes the first 28 bytes of the struct sockaddr_in6. This leaves 4 bytes of the allocated buffer uninitialized, which are then sent over the wire or to userspace via skb_put(). This could allow a local attacker to read small fragments of uninitialized kernel stack or heap memory. The issue has been resolved by ensuring the aligned tail of the sockaddr structure is zeroed.
Affected products
- Linux Linux Kernel 2.6.12-rc2 to 6.12.88, 6.13 to 6.18.30, 6.19 to 6.19.14
Timeline
- 2026-03-22: other: Vulnerability reported/developed by researchers
- 2026-05-06: advisory: Initial CVE publication
- 2026-05-14: patched: Fix committed to stable kernel trees