An information leak vulnerability in rtnetlink subsystem in Linux kernel was found in "net/core/rtnetlink.c". The stack object "map" has a total size of 32 bytes. Its last 4 bytes are padding generated by compiler. These padding bytes are not initialized and sent out via nlaput().

Public via:

http://marc.info/?l=linux-kernel&m=146230821206492&w=2

http://marc.info/?l=linux-netdev&m=146230822606494&w=2

CVE-ID request and assignment:

http://seclists.org/oss-sec/2016/q2/234

http://seclists.org/oss-sec/2016/q2/237

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=5f8e44741f9f216e33736ea4ec65ca9ac03036e6

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5f8e44741f9f216e33736ea4ec65ca9ac03036e6