Executive brief
The Linux kernel's MPLS (Multiprotocol Label Switching) routing subsystem has a memory initialization bug in the mpls_getroute() function that handles RTM_GETROUTE requests. When responding to route queries, the kernel fails to zero-initialize one byte of its response message, causing random heap memory contents to be exposed to unprivileged users who query MPLS routes. While limited to a single byte, this leak can be triggered repeatedly and may enable information gathering attacks or contribute to kernel layout disclosure.
Technical details
The vulnerability is an uninitialized memory disclosure (CWE-200) in the mpls_getroute() function within net/mpls/af_mpls.c. When building an RTM_NEWROUTE netlink response to an RTM_GETROUTE request, the function allocates an skb with unzeroed data and fills a struct rtmsg header. However, it fails to initialize the rtm_tos field (offset 3 in the struct), leaving one byte with whatever value was previously on the heap. This uninitialized byte is copied directly to user space via netlink, leaking kernel heap memory. The vulnerability is exploitable by any unprivileged user who can query MPLS routes via netlink sockets. Detection occurred via KMSAN (KernelMemory Sanitizer). The fix involves adding a single line to initialize rtm_tos = 0, matching the behavior of the related mpls_dump_route() function.
Affected products
- Linux Linux kernel Multiple versions from 2.6.11 through 6.x and beyond
Timeline
- 2026-08-15: disclosed: CVE-2026-74577 published
- 2026-07-23: patched: Fix committed by Yehyeong Lee
- 2026-08-09: other: Patch merged into stable kernel branches