CVE-2026-74577: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-74577 is a kernel information leak vulnerability in the Linux kernel's MPLS (Multiprotocol Label Switching) routing subsystem. The mpls_getroute() function fails to initialize the rtm_tos field of the rtmsg structure before copying it to user space, leaking one byte of uninitialized kernel heap memory per RTM_GETROUTE netlink request. The vulnerability affects Linux kernel versions from 4.13 onward and was disclosed on August 15, 2026. Fixed versions include 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. The CVSS base score is estimated as Medium (GitHub Advisory, Feedly).

The root cause is a use of uninitialized memory (CWE-200 / kernel infoleak) in net/mpls/af_mpls.c. When mpls_getroute() builds an RTM_NEWROUTE reply, it allocates an skb via alloc_skb(NLMSG_GOODSIZE, ...), which does not zero the data area. All fields of the embedded struct rtmsg are explicitly set except rtm_tos (at byte offset 3 within the struct, byte 19 of the netlink message), which retains whatever value was in the heap at allocation time. Because struct rtmsg has no padding, this uninitialized byte is copied directly to user space via recvmsg(). The sister function mpls_dump_route() correctly sets rtm_tos = 0, making the omission in mpls_getroute() an inconsistency. The bug was confirmed using KMSAN (Kernel Memory Sanitizer), which reported a kernel-infoleak in _copy_to_iter triggered by issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE request for an MPLS route label (GitHub Advisory).

Exploitation allows a local or network-accessible user with access to netlink sockets to read one byte of uninitialized kernel heap memory per query. While the leak is limited to a single byte, repeated queries could be used to probabilistically reconstruct sensitive kernel heap contents, potentially aiding in bypassing kernel ASLR or leaking cryptographic material, pointer values, or other sensitive data. The confidentiality impact is low-to-medium; there is no integrity or availability impact (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The EPSS score is 0.0, indicating very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Prerequisite: Obtain access to a Linux system running kernel version 4.13 or later with MPLS support enabled and at least one MPLS route configured. Access to netlink sockets (typically available to local users or processes with CAP_NET_ADMIN in some configurations) is required.
2. Add an MPLS route: Ensure an MPLS route exists on the target system (e.g., using ip -f mpls route add ...).
3. Craft a netlink RTM_GETROUTE request: Using a raw netlink socket (AF_NETLINK / NETLINK_ROUTE), construct an RTM_GETROUTE message for the MPLS route label, ensuring the RTM_F_FIB_MATCH flag is NOT set.
4. Send the request and receive the reply: Call sendmsg() to send the crafted request, then call recvmsg() to receive the RTM_NEWROUTE reply.
5. Extract the leaked byte: Parse the received rtmsg structure and read byte offset 3 (rtm_tos), which contains an uninitialized byte from the kernel heap.
6. Repeat for information gathering: Issue repeated requests to collect multiple heap bytes, potentially reconstructing sensitive kernel data to assist in further exploitation (GitHub Advisory).

• Logs: Kernel KMSAN reports of kernel-infoleak in _copy_to_iter with stack traces referencing mpls_getroute, rtnetlink_rcv_msg, and netlink_recvmsg in kernel logs (dmesg / /var/log/kern.log).
• Network/System: Unusual or repeated RTM_GETROUTE netlink requests for MPLS route labels from unprivileged or unexpected processes, observable via strace or netlink monitoring tools (e.g., nlmon interface with tcpdump).
• Process: Processes unexpectedly opening AF_NETLINK / NETLINK_ROUTE sockets and issuing MPLS route queries, particularly in environments where MPLS is not routinely administered.

Update the Linux kernel to a patched version: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 (or later). The fix initializes rtm_tos = 0 in mpls_getroute(), matching the existing behavior of mpls_dump_route(). As a workaround where upgrading is not immediately feasible, restrict access to netlink sockets using Linux Security Modules (e.g., SELinux, AppArmor) or seccomp policies to limit which processes can issue RTM_GETROUTE requests. Disabling MPLS support in the kernel configuration (CONFIG_MPLS_ROUTING=n) eliminates the attack surface entirely if MPLS is not required (GitHub Advisory).

The vulnerability received routine coverage from automated CVE tracking services and aggregators shortly after disclosure. A Reddit post in the r/pwnhub community included it in a daily CVE brief on August 16, 2026. No notable researcher commentary or vendor statements beyond the kernel patch itself have been identified (GitHub Advisory).