Skip to main content

Linux Kernel CVE-2026-43040

| EUVDEUVD-2026-26639 HIGH
Missing Initialization of Resource (CWE-909)
2026-05-01 Linux
Information Disclosure Linux
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local privileged netlink listener needed (AV:L, PR:L); only kernel memory disclosure results, so C:H with I:N and A:N - the input's A:H is unjustified for an info-leak.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
4.7 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 01:14 vuln.today
CVSS changed
May 08, 2026 - 19:07 NVD
7.1 (HIGH)
Patch available
May 01, 2026 - 16:33 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26639
CVE Published
May 01, 2026 - 14:15 nvd
HIGH 7.1
CVE Published
May 01, 2026 - 14:15 nvd
N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak

When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data

The fix is simple, just zeroes the padding fields.

AnalysisAI

Kernel memory disclosure in the Linux kernel IPv6 neighbor discovery code (ndisc_ra_useropt) allows leaking uninitialized kernel stack/heap data to netlink listeners. When the kernel processes IPv6 Router Advertisements carrying user options, it builds an RTM_NEWNDUSEROPT netlink message whose nduseroptmsg struct contains three padding fields that were never zeroed, exposing residual kernel data. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), consistent with a low-severity information-leak that requires a local privileged netlink listener rather than a remotely weaponizable flaw.

Technical ContextAI

The vulnerability lives in the IPv6 Neighbor Discovery (ND, RFC 4861) subsystem of the Linux networking stack, specifically net/ipv6/ndisc.c. When a host receives a Router Advertisement (RA) containing RDNSS/DNSSL-style user options, the kernel relays them to userspace by constructing an RTM_NEWNDUSEROPT netlink message built around the nduseroptmsg structure. That struct includes alignment/padding bytes (nduseropt_pad1/pad2 and related reserved fields) which the code copied into the skb without first zeroing them, so previously-used kernel memory occupying those padding bytes is transmitted verbatim. This maps to CWE-909 (Missing Initialization of a Resource): the defect is failure to initialize memory before disclosure, a classic kernel info-leak pattern that KASAN/kmemleak-style hardening and struct zeroing (memset) are meant to prevent. CPE data identifies the affected component simply as cpe:2.3:a:linux:linux, i.e. the mainline kernel, with the bug present since the user-option relay was introduced in 2.6.24.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.19.12, 6.18.22, 6.12.81, 6.6.134, 6.1.168, 5.15.203 or 5.10.253 (or 7.0), whichever matches your branch; the upstream commits are available at git.kernel.org (e.g. https://git.kernel.org/stable/c/ef3645606e4a635d5062a492f22b7f490852ee67 and the other listed stable hashes). Distribution users should apply their vendor kernel update: Ubuntu users follow USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1), and Siemens product operators follow SSA-019113 and SSA-082556. Because the leak is only observable by a process able to subscribe to ND user-option netlink messages, an interim compensating control where patching is delayed is to restrict CAP_NET_ADMIN and RTNLGRP_ND_USEROPT netlink group access to trusted processes only, or to disable acceptance of IPv6 Router Advertisement user options (e.g. via sysctl net.ipv6.conf.*.accept_ra_rt_info / accept_ra where appropriate) - the trade-off is loss of RA-provided DNS/route configuration on affected interfaces, which breaks IPv6 autoconfiguration in environments that rely on it.

Same weakness CWE-909 – Missing Initialization of Resource

View all
CVE-2021-29980 HIGH POC
8.8
CVE-2021-36513 HIGH POC
7.5
CVE-2021-28167 MEDIUM POC
6.5
CVE-2020-12352 MEDIUM POC
6.5
CVE-2021-34693 MEDIUM POC
5.5
CVE-2020-20739 MEDIUM POC
5.3
CVE-2020-12523 CRITICAL
9.1
CVE-2021-23994 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43040 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy