Executive brief
A vulnerability in the Linux kernel's Remote Network Block Device (RNBD) server could allow sensitive information to be leaked from the server to a client. The issue occurs because the server fails to clear memory buffers before sending response messages, potentially including 'stray bytes' from previous operations. This could result in the unauthorized disclosure of system memory contents during normal network communication between different protocol versions.
Technical details
An information disclosure vulnerability exists in the Linux kernel's rnbd-srv component due to uninitialized memory buffers. Specifically, the functions 'rnbd_srv_fill_msg_open_rsp' and 'process_msg_sess_info' do not zero out the response buffer before populating it with data. When messages are exchanged between clients and servers using different protocol versions, 'stray bytes' from previous memory use may remain in the buffer and be transmitted over the network. An attacker or malicious client could potentially capture these bytes to read sensitive information from the server's kernel memory. The issue has been resolved by adding 'memset' calls to ensure buffers are fully cleared before use.
Affected products
- Linux Linux kernel 5.8 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-12-05: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-06: advisory
References
- https://git.kernel.org/stable/c/30868a6a5238849d554295aff3ce61d242d7fad8
- https://git.kernel.org/stable/c/69d26698e4fd44935510553809007151b2fe4db5
- https://git.kernel.org/stable/c/7aac0a30dcf41cdb510526740d9a2ab1520c5d98
- https://git.kernel.org/stable/c/852475278ca5e96e0c0275950e1a84203e602b33
- https://git.kernel.org/stable/c/b646e54d23b9b592d612a2036aab14e0f6c14206
- https://git.kernel.org/stable/c/c94ede3c436dfbd9cedd9cb69f604f6fc901b6a2
- https://git.kernel.org/stable/c/e2cacec7d4291300a282feb3af8eba57b93b15aa