Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to view sensitive information from the system's memory. By requesting specific network interface information, an attacker can retrieve small pieces of data that were previously stored on the kernel's internal stack. This could potentially expose sensitive data such as return addresses or other transient system information.
Technical details
A stack information leak exists in the rtnl_fill_vfinfo() function within net/core/rtnetlink.c. The function declares a 32-byte 'ifla_vf_broadcast' structure on the stack but fails to initialize it. When processing Ethernet devices, only the first 6 bytes are populated via memcpy, leaving the remaining 26 bytes of stack residue intact. This uninitialized data is then transmitted to userspace via nla_put(). An unprivileged local process can trigger this leak by sending an RTM_GETLINK request with the RTEXT_FILTER_VF filter. The fix involves explicitly zeroing the structure using memset() before the partial copy.
Affected products
- Linux Linux kernel Fixed in 0653c0516234c8258975d268a749115fc0f0ff00, 38bcc21f52246badb3154b6158dcb381d98de011, 4b9e327991815e128ad3af75c3a04630a63ce3e0, c5b1b92ab7eff1a6e8c507ddde6fd02fabd0cfa8, fbe0e6197225e6a83cf113a67a4b425f8de0bcd5
Timeline
- 2026-04-30: patched: Initial patch authored by Kai Zen
- 2026-05-28: advisory: CVE-2026-46132 published by NVD
References
- https://git.kernel.org/stable/c/0653c0516234c8258975d268a749115fc0f0ff00
- https://git.kernel.org/stable/c/38bcc21f52246badb3154b6158dcb381d98de011
- https://git.kernel.org/stable/c/4b9e327991815e128ad3af75c3a04630a63ce3e0
- https://git.kernel.org/stable/c/c5b1b92ab7eff1a6e8c507ddde6fd02fabd0cfa8
- https://git.kernel.org/stable/c/fbe0e6197225e6a83cf113a67a4b425f8de0bcd5