CVE-2026-45930 (GCVE-0-2026-45930)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-06-19 11:58
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mctp: ensure our nlmsg responses are initialised Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from DEVCORE Research Team working with Trend Micro Zero Day Initiative report that a RTM_GETNEIGH will return uninitalised data in the pad bytes of the ndmsg data. Ensure we're initialising the netlink data to zero, in the link, addr and neigh response messages.
References
Impacted products
Vendor Product Version
Linux Linux Version: 583be982d93479ea3d85091b0fd0b01201ede87d
Version: 583be982d93479ea3d85091b0fd0b01201ede87d
Version: 583be982d93479ea3d85091b0fd0b01201ede87d
Version: 583be982d93479ea3d85091b0fd0b01201ede87d
Version: 583be982d93479ea3d85091b0fd0b01201ede87d
Version: 583be982d93479ea3d85091b0fd0b01201ede87d
Version: 583be982d93479ea3d85091b0fd0b01201ede87d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mctp/device.c",
            "net/mctp/neigh.c",
            "net/mctp/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b37da3ac099e145bcd3be82c745a8d335772e3af",
              "status": "affected",
              "version": "583be982d93479ea3d85091b0fd0b01201ede87d",
              "versionType": "git"
            },
            {
              "lessThan": "c4f840437e7641764de15f2de951ac8335d641f1",
              "status": "affected",
              "version": "583be982d93479ea3d85091b0fd0b01201ede87d",
              "versionType": "git"
            },
            {
              "lessThan": "963537a26fd892f7e414a091f807b44aeee97a7d",
              "status": "affected",
              "version": "583be982d93479ea3d85091b0fd0b01201ede87d",
              "versionType": "git"
            },
            {
              "lessThan": "976612471a9e6ead6ceffc241e4d0a1aac90b36a",
              "status": "affected",
              "version": "583be982d93479ea3d85091b0fd0b01201ede87d",
              "versionType": "git"
            },
            {
              "lessThan": "54ed418de62a148a655262da682a050fa05f7924",
              "status": "affected",
              "version": "583be982d93479ea3d85091b0fd0b01201ede87d",
              "versionType": "git"
            },
            {
              "lessThan": "6fb6a97c86abb8592158088afaea0eb464cf9de1",
              "status": "affected",
              "version": "583be982d93479ea3d85091b0fd0b01201ede87d",
              "versionType": "git"
            },
            {
              "lessThan": "a6a9bc544b675d8b5180f2718ec985ad267b5cbf",
              "status": "affected",
              "version": "583be982d93479ea3d85091b0fd0b01201ede87d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mctp/device.c",
            "net/mctp/neigh.c",
            "net/mctp/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp: ensure our nlmsg responses are initialised\n\nSyed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from\nDEVCORE Research Team working with Trend Micro Zero Day Initiative\nreport that a RTM_GETNEIGH will return uninitalised data in the pad\nbytes of the ndmsg data.\n\nEnsure we\u0027re initialising the netlink data to zero, in the link, addr\nand neigh response messages."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T11:58:46.478Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b37da3ac099e145bcd3be82c745a8d335772e3af"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4f840437e7641764de15f2de951ac8335d641f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/963537a26fd892f7e414a091f807b44aeee97a7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/976612471a9e6ead6ceffc241e4d0a1aac90b36a"
        },
        {
          "url": "https://git.kernel.org/stable/c/54ed418de62a148a655262da682a050fa05f7924"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fb6a97c86abb8592158088afaea0eb464cf9de1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6a9bc544b675d8b5180f2718ec985ad267b5cbf"
        }
      ],
      "title": "net: mctp: ensure our nlmsg responses are initialised",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45930",
    "datePublished": "2026-05-27T12:17:48.689Z",
    "dateReserved": "2026-05-13T15:03:33.086Z",
    "dateUpdated": "2026-06-19T11:58:46.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.