Skip to main content

Linux Kernel CVE-2026-45930

| EUVDEUVD-2026-32214 MEDIUM
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-m7mh-8j45-fp89
Linux Information Disclosure Trend Micro Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
3.3 LOW

Local PR:L access leaks pad bytes (C:L); no integrity or availability impact matches an uninitialized disclosure-only flaw.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 25, 2026 - 12:55 vuln.today
CVSS changed
Jun 25, 2026 - 12:52 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: ensure our nlmsg responses are initialised

Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from DEVCORE Research Team working with Trend Micro Zero Day Initiative report that a RTM_GETNEIGH will return uninitalised data in the pad bytes of the ndmsg data.

Ensure we're initialising the netlink data to zero, in the link, addr and neigh response messages.

AnalysisAI

Uninitialized kernel memory leaks to local users via the MCTP netlink subsystem in the Linux kernel, where RTM_GETNEIGH responses return stale kernel data in the pad bytes of ndmsg structures across link, addr, and neigh response messages. Any local user with PR:L access to the MCTP netlink interface can extract arbitrary pad-byte contents from kernel memory allocations, potentially exposing pointers, partial stack data, or remnants of prior allocations that could assist in defeating kernel address space layout randomization (KASLR). Disclosed by Syed Faraz Abrar (Zellic) and Pumpkin (DEVCORE Research Team) via Trend Micro Zero Day Initiative; no public exploit code exists and EPSS sits at the 5th percentile (0.02%), indicating negligible active exploitation at time of analysis.

Technical ContextAI

MCTP (Management Component Transport Protocol, RFC 4282) is a kernel networking subsystem used for system management plane communication, typically between host firmware and baseboard management controllers (BMCs) in server environments. The vulnerability resides in the kernel's netlink response construction for MCTP - specifically the handlers that produce RTM_GETNEIGH, RTM_GETLINK, and RTM_GETADDR reply messages. When these handlers allocate and populate ndmsg structures to send back via rtnetlink, they fail to zero-initialize the full allocation before writing named fields, leaving the pad[] bytes carrying uncleared slab or stack memory. The root cause is a classic CWE-908 (use of uninitialized resource) / CWE-200 (information exposure) pattern: structured message types with explicit padding fields require memset-to-zero before selective field assignment. The affected CPE is cpe:2.3:o:linux:linux_kernel across multiple stable branches, confirmed by fixes backported to Linux 5.15, 6.x, 6.19.4, and 7.0 stable series.

RemediationAI

The primary fix is to update to Linux kernel 6.19.4 or 7.0 (with MCTP netlink patch applied), which zero-initializes the ndmsg and related netlink response structures in the MCTP link, addr, and neigh handlers. Patches are available as stable-tree commits at https://git.kernel.org/stable/c/6fb6a97c86abb8592158088afaea0eb464cf9de1 and https://git.kernel.org/stable/c/a6a9bc544b675d8b5180f2718ec985ad267b5cbf among others; distribution kernel maintainers (Red Hat, Ubuntu, SUSE, Debian) should carry these backports into their stable streams. For environments that cannot patch immediately, a targeted compensating control is to restrict access to MCTP netlink sockets via Linux Security Module policies (SELinux, AppArmor) or by removing the MCTP kernel module (modprobe -r mctp) if MCTP is not operationally required - the latter eliminates attack surface entirely but will break any BMC-over-MCTP management plane. If MCTP is required, restricting RTM_GETNEIGH queries via seccomp filters on untrusted local processes limits exposure. No advisory URL beyond NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-45930) and VulDB (https://vuldb.com/vuln/366157) is currently published.

More in Trend Micro

View all
CVE-2016-7552 CRITICAL POC
9.8 Apr 12

On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows
CVE-2016-7547 CRITICAL POC
9.8 Apr 12

A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in

CVE-2017-11394 CRITICAL POC
9.8 Aug 03

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitr
CVE-2017-11391 HIGH POC
8.8 Aug 03

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote att
CVE-2017-11392 HIGH POC
8.8 Aug 03

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote att
CVE-2016-6267 HIGH POC
8.8 Jan 30

SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330
CVE-2017-6398 HIGH POC
8.8 Mar 14

An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. Rated high severity (C
CVE-2017-7896 MEDIUM POC
6.1 Apr 18

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS. Rated medium severity (CV
CVE-2017-14078 CRITICAL
9.8 Sep 22

SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attac
CVE-2016-3987 CRITICAL POC
9.8 Apr 12

The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url para
CVE-2017-14089 CRITICAL POC
9.8 Oct 06

An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated u
CVE-2020-8606 CRITICAL POC
9.8 May 27

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authent

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-45930 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy