PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45930 Linux CVE debrief

A vulnerability in the Linux kernel's MCTP (Management Component Transport Protocol) netlink implementation could allow unprivileged users to read uninitialized kernel memory. The issue affects RTM_GETNEIGH responses where padding bytes in ndmsg structures were not zero-initialized, potentially leaking sensitive kernel data to user space. The vulnerability was reported by Syed Faraz Abrar of Zellic and Pumpkin of DEVCORE Research Team working with Trend Micro Zero Day Initiative. The fix ensures proper zero-initialization of netlink response data for link, address, and neighbor messages.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators, kernel maintainers, and security teams monitoring for information disclosure vulnerabilities in networking subsystems. Organizations running workloads with unprivileged user access to netlink sockets should prioritize patching.

Technical summary

The Linux kernel's MCTP (Management Component Transport Protocol) subsystem failed to initialize padding bytes in netlink response messages for RTM_GETNEIGH operations. The ndmsg structure contains pad bytes that were not zeroed before copying to user space, potentially exposing uninitialized kernel stack or heap memory. The vulnerability affects the net/mctp implementation where nlmsg responses for link, address, and neighbor messages lacked proper initialization. The resolution adds zero-initialization of netlink message data before population and transmission to user space.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable kernel releases containing commits 6fb6a97c86abb8592158088afaea0eb464cf9de1 and a6a9bc544b675d8b5180f2718ec985ad267b5cbf
  • Monitor for kernel updates addressing CVE-2026-45930 in distribution security advisories
  • Restrict unprivileged access to netlink sockets where possible through security policies
  • Review systems for unexpected netlink activity that may indicate information gathering attempts

Evidence notes

The vulnerability description indicates that RTM_GETNEIGH netlink messages return uninitialized padding bytes in ndmsg data structures. The fix commit initializes netlink response data to zero for link, addr, and neigh messages. Two kernel.org stable commits are referenced as resolution sources.

Official resources

2026-05-27