Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74577— net: mpls: initialize rtm_tos in mpls_getroute()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于mpls_getroute()函数未初始化rtm_tos字段，可能导致未初始化的堆内存字节泄露。

AI Predicted 4.9 Difficulty: Easy EPSS 0.17% · P5

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 397fc9e5cefee0c33b86811fbddb0decb7288c52< 248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1 affected
397fc9e5cefee0c33b86811fbddb0decb7288c52< 466b474a8deb0c93b5280c6d261e5eda6482eca7 affected
397fc9e5cefee0c33b86811fbddb0decb7288c52< ba56f88aab18d982f2a21f11390f4d8a8897782a affected
397fc9e5cefee0c33b86811fbddb0decb7288c52< 95651461cf77cc6590fa08c87667717e5dcfa55d affected
397fc9e5cefee0c33b86811fbddb0decb7288c52< 1fea5ff0eb4aa7e951bb3d380248566c473aa377 affected
397fc9e5cefee0c33b86811fbddb0decb7288c52< a5cdd2407dd890f741f59b8367e4c6c101cce154 affected
397fc9e5cefee0c33b86811fbddb0decb7288c52< 2dc2fffc704a4365cae1aae078ba62223aaeff93 affected
397fc9e5cefee0c33b86811fbddb0decb7288c52< 295dd295e2137e10e9a5b1891d97e0f08de76f03 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74577

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: mpls: initialize rtm_tos in mpls_getroute()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtm_tos in mpls_getroute() mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every field of the header except rtm_tos: r = nlmsg_data(nlh); r->rtm_family = AF_MPLS; r->rtm_dst_len = 20; r->rtm_src_len = 0; r->rtm_table = RT_TABLE_MAIN; r->rtm_type = RTN_UNICAST; r->rtm_scope = RT_SCOPE_UNIVERSE; r->rtm_protocol = rt->rt_protocol; r->rtm_flags = 0; struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mpls_dump_route(), which fills the very same header and does set rtm_tos = 0. Initialize rtm_tos to 0, matching mpls_dump_route(). Reproduced with KMSAN by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0 _copy_to_iter+0x36c/0x33f0 __skb_datagram_iter+0x196/0x12c0 skb_copy_datagram_iter+0x5b/0x210 netlink_recvmsg+0x37b/0xef0 ... Uninit was created at: __alloc_skb+0x8ca/0x10e0 mpls_getroute+0x1280/0x3a40 rtnetlink_rcv_msg+0x1138/0x15a0 ... Byte 19 of 64 is uninitialized (byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于mpls_getroute()函数未初始化rtm_tos字段，可能导致未初始化的堆内存字节泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 397fc9e5cefee0c33b86811fbddb0decb7288c52 ~ 248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1 -
Linux Linux 4.13 -

II. Public POCs for CVE-2026-74577

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74577

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74577 (5)

Same Patch Batch · Linux · 2026-08-15 · 844 CVEs total

CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72319 9.8 CRITICAL ipvs: ensure inner headers in ICMP errors are in headroom
CVE-2026-72220 9.8 CRITICAL sunrpc: harden rq_procinfo lifecycle to prevent double-free
CVE-2026-72217 9.8 CRITICAL SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
CVE-2026-74384 9.8 CRITICAL nvme-multipath: fix flex array size in struct nvme_ns_head
CVE-2026-72299 9.8 CRITICAL tipc: restrict socket queue dumps in enqueue tracepoints
CVE-2026-72210 9.8 CRITICAL ntfs: fix off-by-one in mapping pairs decoding bounds checks
CVE-2026-72211 9.8 CRITICAL ntfs: grow index root value before reparent header update
CVE-2026-72317 9.8 CRITICAL SUNRPC: pin upper rpc_clnt across the TLS connect_worker
CVE-2026-72209 9.8 CRITICAL ntfs: validate attribute values on lookup
CVE-2026-74268 9.8 CRITICAL tcp: clear sock_ops cb flags before force-closing a child socket
CVE-2026-72207 9.8 CRITICAL ntfs: not change 0-byte $DATA attribute to non-resident
CVE-2026-74267 9.8 CRITICAL net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring q

Showing top 20 of 844 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74577

No comments yet

Leave a comment