CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute()
In the Linux kernel, the following vulnerability has been resolved:
net: mpls: initialize rtmtos in mplsgetroute()
mplsgetroute() builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (allocskb(NLMSGGOODSIZE, ...)). It sets every field of the header except rtmtos:
r = nlmsgdata(nlh); r->rtmfamily = AFMPLS; r->rtmdstlen = 20; r->rtmsrclen = 0; r->rtmtable = RTTABLEMAIN; r->rtmtype = RTNUNICAST; r->rtmscope = RTSCOPEUNIVERSE; r->rtmprotocol = rt->rtprotocol; r->rtmflags = 0;
struct rtmsg has no padding, so the one uninitialised byte rtmtos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mplsdumproute(), which fills the very same header and does set rtmtos = 0.
Initialize rtmtos to 0, matching mplsdumproute().
Reproduced with KMSAN by adding an MPLS route and issuing a non-RTMFFIBMATCH RTMGETROUTE for its label:
BUG: KMSAN: kernel-infoleak in copytoiter+0x36c/0x33f0 copytoiter+0x36c/0x33f0 skbdatagramiter+0x196/0x12c0 skbcopydatagramiter+0x5b/0x210 netlinkrecvmsg+0x37b/0xef0 ... Uninit was created at: allocskb+0x8ca/0x10e0 mplsgetroute+0x1280/0x3a40 rtnetlinkrcvmsg+0x1138/0x15a0 ... Byte 19 of 64 is uninitialized
(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtmtos)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Initialize the RTM route header field rtm_tos to 0 in the MPLS netlink route handling path (match the behavior of mpls_dump_route()).
Linux kernel net: mpls rtm_tos initialization in mpls_getroute()/mpls_dump_route() = rtm_tos = 0 - Operational
Re-test the MPLS netlink route retrieval (RTM_GETROUTE / RTM_NEWROUTE reply via mpls_getroute) to confirm the kernel-infoleak is no longer present after initializing rtm_tos.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74577?
CVE-2026-74577 is rated with a severity score of 9, indicating a critical risk.
What type of vulnerability is CVE-2026-74577?
CVE-2026-74577 is categorized as an information leak vulnerability in the Linux kernel.
How do I fix CVE-2026-74577?
To mitigate CVE-2026-74577, upgrade the Linux kernel to the patched version provided by the maintainers.
What component of the Linux kernel is affected by CVE-2026-74577?
CVE-2026-74577 affects the networking component, specifically related to MPLS route management.
When was CVE-2026-74577 published?
CVE-2026-74577 was published on August 15, 2026.