CVE-2026-52985: netdevsim: zero initialize struct iphdr in dummy sk_buff
In the Linux kernel, the following vulnerability has been resolved:
netdevsim: zero initialize struct iphdr in dummy skbuff
Syzbot reports a KMSAN uninit-value originating from nsimdevtrapskbbuild, with the allocation also being performed in the same function.
Fix this by calling skbputzero instead of skbput to guarantee zero initialization of the whole IP header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
In nsim_dev_trap_skb_build, call skb_put_zero instead of skb_put when allocating the dummy sk_buff, ensuring the entire struct iphdr is zero-initialized.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The reported severity vector requires local access and low privileges. No user interaction is required.
What is the impact if exploitation succeeds?
The severity vector indicates an availability impact only, with no reported confidentiality or integrity impact. It is rated medium severity with a 5.5 score.
What should teams do if they use an affected kernel?
Apply an available patch. The fix changes the dummy sk_buff IP-header allocation in netdevsim to use skb_put_zero so the header is fully initialized.