Executive brief
A vulnerability in the Linux kernel's IEEE 802.15.4 networking stack causes uninitialized memory to be leaked to user space when receiving network packets. An attacker or local user could read sensitive kernel memory by receiving specially crafted IEEE 802.15.4 frames, potentially exposing cryptographic keys, addresses, or other confidential kernel data.
Technical details
A kernel information leak exists in the IEEE 802.15.4 socket implementation in dgram_recvmsg(). The vulnerability occurs in ieee802154_hdr_get_addr() when processing addresses with mode IEEE802154_ADDR_NONE—the pan_id field is left uninitialized instead of being zeroed. This uninitialized stack memory is subsequently copied into a sockaddr_ieee802154 structure via ieee802154_addr_to_sa() and finally exposed to user space by move_addr_to_user(), leaking kernel memory. The issue requires no authentication and affects any process receiving IEEE 802.15.4 packets. The fix involves zeroing the address structure with memset when the address mode is IEEE802154_ADDR_NONE.
Affected products
- Linux Linux Kernel unknown
Timeline
- 2026-08-15: disclosed