CVE-2026-74659

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mrp: fix uninitialised bytes on the wire

br_mrp_alloc_test_skb() builds MRP test frames on an skb from

dev_alloc_skb(), which does not clear the linear data area. On the MRA

ring-role branch the sub-option TLV header is appended with

sub_tlv = skb_put(skb, sizeof(*sub_tlv));

sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;

so sub_tlv->length is never written, and the two trailing alignment bytes

are appended with a bare skb_put() that does not clear them either. The

neighbouring oui and sub_opt regions are explicitly zeroed, so three

uninitialised bytes are left in every MRA MRP_Test frame that goes out.

Put the sub-option TLV header and the alignment padding in a single

skb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no

payload, so the zeroed length field is already the value it should have.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References