CVE-2026-72441: ieee802154: fix kernel-infoleak in dgram_recvmsg()
In the Linux kernel, the following vulnerability has been resolved:
ieee802154: fix kernel-infoleak in dgramrecvmsg()
KMSAN reported a kernel-infoleak in moveaddrtouser():
BUG: KMSAN: kernel-infoleak in instrumentcopytouser include/linux/instrumented.h:131 [inline] BUG: KMSAN: kernel-infoleak in inlinecopytouser include/linux/uaccess.h:205 [inline] BUG: KMSAN: kernel-infoleak in copytouser+0xcc/0x120 lib/usercopy.c:26 instrumentcopytouser include/linux/instrumented.h:131 [inline] inlinecopytouser include/linux/uaccess.h:205 [inline] copytouser+0xcc/0x120 lib/usercopy.c:26 copytouser include/linux/uaccess.h:236 [inline] moveaddrtouser+0x2e7/0x440 net/socket.c:302 sysrecvmsg+0x232/0x610 net/socket.c:2925 ... Uninit was stored to memory at: ieee802154addrtosa include/net/ieee802154netdev.h:369 [inline] dgramrecvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739
The issue occurs because the panid field of struct ieee802154addr is left uninitialized when the address mode is IEEE802154ADDRNONE. The execution flow is as follows:
1. ieee802154rxhandlepacket() declares a local struct ieee802154hdr hdr on the stack. 2. ieee802154hdrpull() calls ieee802154hdrgetaddr() to parse the source and destination addresses into this structure. 3. If the address mode is IEEE802154ADDRNONE, ieee802154hdrgetaddr() previously only set the mode field, leaving the panid field containing uninitialized stack memory. 4. This uninitialized panid is later copied into a struct sockaddrieee802154 in dgramrecvmsg() via ieee802154addrtosa(). 5. Finally, moveaddrtouser() copies the socket address structure to user space, leaking the uninitialized bytes.
Fix this by using memset to zero out the address structure in ieee802154hdrgetaddr() when the mode is IEEE802154ADDRNONE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the Linux kernel fix for ieee802154: zero out the destination `struct ieee802154_addr` (e.g., via `memset`) before copying it to `user space` in `move_addr_to_user()` when the address mode is `IEEE802154_ADDR_NONE`, ensuring the `pan_id` field is not left uninitialized and leaked via `copy_to_user()` in `dgram_recvmsg()`.
Linux kernel (ieee802154) IEEE802154_ADDR_NONE handling in ieee802154_hdr_get_addr()/move_addr_to_user() = memset address structure to zero before copying to user