CVE-2026-45930

net: mctp: ensure our nlmsg responses are initialised

State: Published
Severity: Not scored
Published: May 27, 2026
Updated: Jun 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: ensure our nlmsg responses are initialised

Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from DEVCORE Research Team working with Trend Micro Zero Day Initiative report that a RTM_GETNEIGH will return uninitalised data in the pad bytes of the ndmsg data.

Ensure we're initialising the netlink data to zero, in the link, addr and neigh response messages.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	583be982d93479ea3d85091b0fd0b01201ede87d to before b37da3ac099e145bcd3be82c745a8d335772e3afAffected 583be982d93479ea3d85091b0fd0b01201ede87d to before c4f840437e7641764de15f2de951ac8335d641f1Affected 583be982d93479ea3d85091b0fd0b01201ede87d to before 963537a26fd892f7e414a091f807b44aeee97a7dAffected 583be982d93479ea3d85091b0fd0b01201ede87d to before 976612471a9e6ead6ceffc241e4d0a1aac90b36aAffected 583be982d93479ea3d85091b0fd0b01201ede87d to before 54ed418de62a148a655262da682a050fa05f7924Affected 583be982d93479ea3d85091b0fd0b01201ede87d to before 6fb6a97c86abb8592158088afaea0eb464cf9de1Affected 583be982d93479ea3d85091b0fd0b01201ede87d to before a6a9bc544b675d8b5180f2718ec985ad267b5cbfAffected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 6.19.4 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

583be982d93479ea3d85091b0fd0b01201ede87d to before b37da3ac099e145bcd3be82c745a8d335772e3afAffected
583be982d93479ea3d85091b0fd0b01201ede87d to before c4f840437e7641764de15f2de951ac8335d641f1Affected
583be982d93479ea3d85091b0fd0b01201ede87d to before 963537a26fd892f7e414a091f807b44aeee97a7dAffected
583be982d93479ea3d85091b0fd0b01201ede87d to before 976612471a9e6ead6ceffc241e4d0a1aac90b36aAffected
583be982d93479ea3d85091b0fd0b01201ede87d to before 54ed418de62a148a655262da682a050fa05f7924Affected
583be982d93479ea3d85091b0fd0b01201ede87d to before 6fb6a97c86abb8592158088afaea0eb464cf9de1Affected
583be982d93479ea3d85091b0fd0b01201ede87d to before a6a9bc544b675d8b5180f2718ec985ad267b5cbfAffected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
6.19.4 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.