Vulnerabilities & PatchesEmerging1 src
CVE-2026-74577 - net: mpls: initialize rtm_tos in mpls_getroute()
CVE ID : CVE-2026-74577
Published : Aug. 15, 2026, 1:18 p. m.
• 7 hours, 48 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:
net: mpls: initialize rtm_tos in mpls_getroute()
mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...) ). It sets every field of the header except rtm_tos:
r = nlmsg_data(nlh); r-rtm_family = AF_MPLS; r-rtm_dst_len = 20; r-rtm_src_len = 0; r-rtm_table = RT_TABLE_MAIN; r-rtm_type = RTN_UNICAST; r-rtm_scope = RT_SCOPE_UNIVERSE; r-rtm_protocol = rt-rt_protocol; r-rtm_flags = 0;
struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory.
