PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45930 Linux CVE debrief

A vulnerability in the Linux kernel's MCTP (Management Component Transport Protocol) netlink implementation could allow unprivileged users to read uninitialized kernel memory. The issue affects RTM_GETNEIGH responses where padding bytes in ndmsg structures were not zero-initialized, potentially leaking sensitive kernel data to user space. The vulnerability was reported by Syed Faraz Abrar of Zellic and Pumpkin of DEVCORE Research Team working with Trend Micro Zero Day Initiative. The fix ensures proper zero-initialization of netlink response data for link, address, and neighbor messages.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux system administrators, kernel maintainers, and security teams monitoring for information disclosure vulnerabilities in networking subsystems. Organizations running workloads with unprivileged user access to netlink sockets should prioritize patching.

Technical summary

The Linux kernel's MCTP (Management Component Transport Protocol) subsystem failed to initialize padding bytes in netlink response messages for RTM_GETNEIGH operations. The ndmsg structure contains pad bytes that were not zeroed before copying to user space, potentially exposing uninitialized kernel stack or heap memory. The vulnerability affects the net/mctp implementation where nlmsg responses for link, address, and neighbor messages lacked proper initialization. The resolution adds zero-initialization of netlink message data before population and transmission to user space.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable kernel releases containing commits 6fb6a97c86abb8592158088afaea0eb464cf9de1 and a6a9bc544b675d8b5180f2718ec985ad267b5cbf
  • Monitor for kernel updates addressing CVE-2026-45930 in distribution security advisories
  • Restrict unprivileged access to netlink sockets where possible through security policies
  • Review systems for unexpected netlink activity that may indicate information gathering attempts

Evidence notes

The vulnerability description indicates that RTM_GETNEIGH netlink messages return uninitialized padding bytes in ndmsg data structures. The fix commit initializes netlink response data to zero for link, addr, and neigh messages. Two kernel.org stable commits are referenced as resolution sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45930 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45930

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45930 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45930

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6fb6a97c86abb8592158088afaea0eb464cf9de1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a6a9bc544b675d8b5180f2718ec985ad267b5cbf

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.