Skip to main content

Linux Kernel CVE-2026-43040

| EUVDEUVD-2026-26639 HIGH
Missing Initialization of Resource (CWE-909)
2026-05-01 Linux
Information Disclosure Linux
7.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local netlink listener privilege
  2. Delivery
    Send crafted IPv6 RA with user options
  3. Exploit
    Kernel builds RTM_NEWNDUSEROPT with unzeroed padding
  4. Execution
    Read leaked kernel bytes from netlink message
  5. Impact
    Aggregate data to weaken KASLR

Vulnerability Assessment

Weakness
CWE
CWE-909
ASVS 5.0
V15 - Secure Coding and Architecture Missing initialization of resource
Exploitation Conditions

Exploitation requires a local process able to receive RTM_NEWNDUSEROPT netlink messages (the ND user-option relay netlink group, normally gated by CAP_NET_ADMIN), and requires the host to actually process IPv6 Router Advertisements that contain user options - meaning IPv6 and RA acceptance must be enabled on an interface and an RA with user options must be received from the local link. Limiting factors: the attacker cannot control which kernel bytes land in the padding, the disclosure is small and passive, no code execution or data modification is possible, and a privileged netlink listener plus link-local RA delivery are both needed, so this is not remotely or unauthenticatedly exploitable against a default host that has no such listener.
Impact

The real-world risk is low despite the 7.1 (High) CVSS. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) is internally inconsistent with the description: a padding info-leak has no plausible availability impact, yet the vector asserts A:H - this A:H is almost certainly an artifact of automated Linux CNA scoring and should be treated with skepticism (verify with vendor). Confidentiality impact is the only genuine consequence, and even that is a small, non-attacker-controlled disclosure of padding bytes to a listener that must already hold privilege to receive ND user-option netlink events (typically CAP_NET_ADMIN). EPSS is 0.02% (7th percentile) and there is no CISA KEV listing and no public exploit identified, so this is a hardening fix, not an actively exploited priority. No SSVC decision data was provided; based on the description, exploitation status is 'none', automatable is 'no', and technical impact is 'partial'. Bottom line: patch it through normal kernel update cycles, but it does not warrant emergency response.
Exploit ScenarioDerived

A local, network-capable but low-privileged-kernel-facing process that is permitted to subscribe to the RTM_NEWNDUSEROPT netlink group listens for IPv6 Router Advertisement user options; an attacker on the same link (or a rogue router) sends RAs carrying user options to trigger message generation, and the listener reads the unzeroed padding bytes to harvest fragments of kernel memory that may aid subsequent KASLR-bypass or exploitation. No public proof-of-concept is identified, and the local attack vector plus low but non-zero privilege requirement make this an opportunistic information-gathering step rather than a standalone compromise.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Kernel memory disclosure in the Linux kernel IPv6 neighbor discovery code (ndisc_ra_useropt) allows leaking uninitialized kernel stack/heap data to netlink listeners. When the kernel processes IPv6 Router Advertisements carrying user options, it builds an RTM_NEWNDUSEROPT netlink message whose nduseroptmsg struct contains three padding fields that were never zeroed, exposing residual kernel data. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), consistent with a low-severity information-leak that requires a local privileged netlink listener rather than a remotely weaponizable flaw.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.19.12, 6.18.22, 6.12.81, 6.6.134, 6.1.168, 5.15.203 or 5.10.253 (or 7.0), whichever matches your branch; the upstream commits are available at git.kernel.org (e.g. https://git.kernel.org/stable/c/ef3645606e4a635d5062a492f22b7f490852ee67 and the other listed stable hashes). Distribution users should apply their vendor kernel update: Ubuntu users follow USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1), and Siemens product operators follow SSA-019113 and SSA-082556. Because the leak is only observable by a process able to subscribe to ND user-option netlink messages, an interim compensating control where patching is delayed is to restrict CAP_NET_ADMIN and RTNLGRP_ND_USEROPT netlink group access to trusted processes only, or to disable acceptance of IPv6 Router Advertisement user options (e.g. via sysctl net.ipv6.conf.*.accept_ra_rt_info / accept_ra where appropriate) - the trade-off is loss of RA-provided DNS/route configuration on affected interfaces, which breaks IPv6 autoconfiguration in environments that rely on it.

Affected VersionsENISA

Linux patch: 6.19.12
Linux 31910575a9de61e78065e93846e8e7a4894a18bf <ef3645606e4a635d5062a492f22b7f490852ee67
Linux patch: 6.18.22
Linux patch: 0
Linux 31910575a9de61e78065e93846e8e7a4894a18bf <1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c
Linux 31910575a9de61e78065e93846e8e7a4894a18bf <ae05340ccaa9d347fe85415609e075545bec589f
Linux 31910575a9de61e78065e93846e8e7a4894a18bf <2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648
Linux patch: 7.0
Linux patch: 6.6.134
Linux 31910575a9de61e78065e93846e8e7a4894a18bf <b485eef3d97b7aae55ce669b6de555ec81f3d21c
Linux patch: 5.15.203
Linux 31910575a9de61e78065e93846e8e7a4894a18bf <11d7fe97421cfc81549940c20ed5ac9472d6db05
Linux patch: 5.10.253
Linux 31910575a9de61e78065e93846e8e7a4894a18bf <4f810c686fde509d1cdaa706322d9d2531f8f1a4
Linux patch: 6.1.168
Linux patch: 6.12.81
Linux 31910575a9de61e78065e93846e8e7a4894a18bf <7f56d87e527bb5a13c3e8b0d5840cb6332822f6d
Linux 2.6.24

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in the IPv6 Neighbor Discovery (ND, RFC 4861) subsystem of the Linux networking stack, specifically net/ipv6/ndisc.c. When a host receives a Router Advertisement (RA) containing RDNSS/DNSSL-style user options, the kernel relays them to userspace by constructing an RTM_NEWNDUSEROPT netlink message built around the nduseroptmsg structure. That struct includes alignment/padding bytes (nduseropt_pad1/pad2 and related reserved fields) which the code copied into the skb without first zeroing them, so previously-used kernel memory occupying those padding bytes is transmitted verbatim. This maps to CWE-909 (Missing Initialization of a Resource): the defect is failure to initialize memory before disclosure, a classic kernel info-leak pattern that KASAN/kmemleak-style hardening and struct zeroing (memset) are meant to prevent. CPE data identifies the affected component simply as cpe:2.3:a:linux:linux, i.e. the mainline kernel, with the bug present since the user-option relay was introduced in 2.6.24.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local privileged netlink listener needed (AV:L, PR:L); only kernel memory disclosure results, so C:H with I:N and A:N - the input's A:H is unjustified for an info-leak.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 4.7 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
CVSS changed
May 08, 2026 - 19:07 NVD
7.1 (HIGH)
Patch available
May 01, 2026 - 16:33 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
CVE Published
May 01, 2026 - 14:15 nvd
HIGH 7.1
CVE Published
May 01, 2026 - 14:15 nvd
N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak

When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data

The fix is simple, just zeroes the padding fields.

Zero Day Initiative Advisories

ZDI-26-682 Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability Sep 2026

Executive ViewAI

Why It Matters

A memory disclosure vulnerability in the Linux kernel's IPv6 neighbor discovery handling (CVE-2026-43040) exposes uninitialized kernel memory to local privileged processes. While the CVSS score is 7.1, real-world risk is minimal due to requirements for local privileged access and the absence of known public exploits, making this a lower-priority patching concern than critical remote vulnerabilities.

Business Impact: Low
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
Ubiquitous
Linux kernel IPv6 stack runs in nearly all environments
Threat Intel
2
1 source
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-909 – Missing Initialization of Resource

View all
CVE-2021-29980 HIGH POC
8.8
CVE-2021-36513 HIGH POC
7.5
CVE-2021-28167 MEDIUM POC
6.5
CVE-2020-12352 MEDIUM POC
6.5
CVE-2026-64035 CRITICAL
9.8
CVE-2021-34693 MEDIUM POC
5.5
CVE-2020-20739 MEDIUM POC
5.3
CVE-2020-12523 CRITICAL
9.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04 ICSA-26-295-11
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/360669 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://git.kernel.org/stable/c/11d7fe97421cfc81549940c20ed5ac9472d6db05 REF https://git.kernel.org/stable/c/1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c REF https://git.kernel.org/stable/c/2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648 REF https://git.kernel.org/stable/c/4f810c686fde509d1cdaa706322d9d2531f8f1a4 REF https://git.kernel.org/stable/c/7f56d87e527bb5a13c3e8b0d5840cb6332822f6d REF https://git.kernel.org/stable/c/ae05340ccaa9d347fe85415609e075545bec589f REF https://git.kernel.org/stable/c/b485eef3d97b7aae55ce669b6de555ec81f3d21c REF https://git.kernel.org/stable/c/ef3645606e4a635d5062a492f22b7f490852ee67

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy