Executive brief
The Linux kernel's bridge Multiple Ring Protocol (MRP) test frame builder leaves uninitialized memory bytes in network packets. When MRP is used to manage redundant ring topologies in network infrastructure, these three uninitialised bytes in every test frame could leak kernel memory over the network, potentially exposing sensitive data to authenticated observers on the same network.
Technical details
The vulnerability is an uninitialized memory disclosure in the br_mrp_alloc_test_skb() function in net/bridge/br_mrp.c. The function constructs MRP test frames by allocating a socket buffer using dev_alloc_skb(), which does not zero its linear data area. When building MRA (Managed Ring Access) ring-role test frames, the sub-option TLV (Type-Length-Value) header is appended without initializing its length field, and two padding bytes for 32-bit alignment are added without clearing. The result is that three uninitialised bytes are transmitted in every MRA test frame. The fix uses skb_put_zero() instead of separate skb_put() calls to ensure all bytes, including padding and unset length fields, are zeroed. No authentication or special privilege is required to trigger—any MRP operation will emit the affected frames. This is primarily an information disclosure issue rather than code execution or service disruption.
Affected products
- Linux Linux kernel Linux 5.4 and later (affected by commit f7458934b079 in 2020 or earlier; exact backport coverage varies by stable series)
Timeline
- 2026-08-22: disclosed: Published to NVD
- 2026-08-19: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-07-29: other: Original fix authored by Baul Lee