Executive brief
A vulnerability in the Linux kernel's Management Component Transport Protocol (MCTP) implementation could allow a local user to view small amounts of sensitive information from the computer's memory. This occurs because the system fails to clear certain internal data buffers before sending them to a user, potentially leaking fragments of previous system activity. While the risk of a full system takeover is low, it represents a privacy and security risk by exposing data that should remain protected.
Technical details
An information leak vulnerability exists in the Linux kernel's MCTP (Management Component Transport Protocol) subsystem. The functions mctp_fill_addrinfo, mctp_fill_neigh, and mctp_fill_rtinfo fail to initialize the Netlink message headers (struct ifaddrmsg, ndmsg, and rtmsg) using memset before filling their fields. This results in uninitialized padding bytes being sent to userspace in response to RTM_GETNEIGH, RTM_GETADDR, and RTM_GETROUTE requests. A local attacker can exploit this to read small amounts of uninitialized kernel stack or heap memory. The issue has been resolved by adding explicit memset calls to zero out the headers in net/mctp/device.c, net/mctp/neigh.c, and net/mctp/route.c.
Affected products
- Linux Linux Kernel Versions prior to the May 2026 patches (specifically affecting MCTP components)
Timeline
- 2026-02-09: patched: Initial patch authored by Jeremy Kerr
- 2026-05-27: advisory: NVD publication date