CVE-2026-74577

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mpls: initialize rtm_tos in mpls_getroute()

mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE

request by filling a struct rtmsg allocated from an skb whose data

area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every

field of the header except rtm_tos:

r = nlmsg_data(nlh);

r->rtm_family = AF_MPLS;

r->rtm_dst_len = 20;

r->rtm_src_len = 0;

r->rtm_table = RT_TABLE_MAIN;

r->rtm_type = RTN_UNICAST;

r->rtm_scope = RT_SCOPE_UNIVERSE;

r->rtm_protocol = rt->rt_protocol;

r->rtm_flags = 0;

struct rtmsg has no padding, so the one uninitialised byte rtm_tos

(offset 3) is copied straight to user space on recvmsg(), leaking a

byte of uninitialised heap memory. This is in contrast to

mpls_dump_route(), which fills the very same header and does set

rtm_tos = 0.

Initialize rtm_tos to 0, matching mpls_dump_route().

Reproduced with KMSAN by adding an MPLS route and issuing a

non-RTM_F_FIB_MAT

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References