VulnerabilityPublished 15 Aug 2026Updated 6 Nov 2026

CVE-2026-74577: Linux kernel · net: mpls: initialize rtm_tos in mpls_getroute()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ba56f88aab18d982f2a21f11390f4d8a8897782a : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:56 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ba56f88aab18d982f2a21f11390f4d8a8897782a, a5cdd2407dd890f741f59b8367e4c6c101cce154, 95651461cf77cc6590fa08c87667717e5dcfa55d +5

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 397fc9e5cefee0c33b86811fbddb0decb7288c52, < ba56f88aab18d982f2a21f11390f4d8a8897782a	Fixed in ba56f88aab18d982f2a21f11390f4d8a8897782a
LinuxLinux	Affected ≥ 397fc9e5cefee0c33b86811fbddb0decb7288c52, < a5cdd2407dd890f741f59b8367e4c6c101cce154	Fixed in a5cdd2407dd890f741f59b8367e4c6c101cce154
LinuxLinux	Affected ≥ 397fc9e5cefee0c33b86811fbddb0decb7288c52, < 95651461cf77cc6590fa08c87667717e5dcfa55d	Fixed in 95651461cf77cc6590fa08c87667717e5dcfa55d
LinuxLinux	Affected ≥ 397fc9e5cefee0c33b86811fbddb0decb7288c52, < 248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1	Fixed in 248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1
LinuxLinux	Affected ≥ 397fc9e5cefee0c33b86811fbddb0decb7288c52, < 466b474a8deb0c93b5280c6d261e5eda6482eca7	Fixed in 466b474a8deb0c93b5280c6d261e5eda6482eca7
LinuxLinux	Affected ≥ 397fc9e5cefee0c33b86811fbddb0decb7288c52, < 295dd295e2137e10e9a5b1891d97e0f08de76f03	Fixed in 295dd295e2137e10e9a5b1891d97e0f08de76f03

AI-suggested

A fix is available and has been applied in the Linux kernel versions identified by the fixed commit hashes. Users should update their Linux kernel to a version that includes these fixes to prevent the information leak. No additional mitigation steps are indicated by the vendor advisory.

Description

A vulnerability in the Linux kernel's MPLS routing code causes an uninitialized byte (rtm_tos) in the rtmsg structure to be leaked to user space during RTM_GETROUTE requests. This occurs because mpls_getroute() does not initialize the rtm_tos field, unlike mpls_dump_route(). The flaw allows leaking one byte of uninitialized heap memory to user space.

Impact

This vulnerability results in an information leak of one byte of uninitialized kernel heap memory to user space. While the leak is limited to a single byte, it may disclose kernel memory contents that could aid an attacker in further exploitation or information gathering. There is no indication of remote code execution or privilege escalation from this flaw.

Summary

In the Linux kernel, the mpls_getroute() function builds an RTM_NEWROUTE reply by filling a struct rtmsg allocated from an skb whose data area is not zeroed. While most fields are set, the rtm_tos field (offset 3) is left uninitialized. This uninitialized byte is copied to user space on recvmsg(), leaking one byte of uninitialized heap memory. The issue was detected using Kernel Memory Sanitizer (KMSAN) by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label. The vulnerability was fixed by initializing rtm_tos to zero, matching the behavior of mpls_dump_route().

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:56 UTC

Technical details

References

Community reviews

Related threats