CVE-2026-46132
published 2026-05-28CVE-2026-46132: In the Linux kernel, the following vulnerability has been resolved: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo…
high7
In the Linux kernel, the following vulnerability has been resolved:
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
rtnl_fill_vfinfo() declares struct ifla_vf_broadcast on the stack
without initialisation:
struct ifla_vf_broadcast vf_broadcast;
The struct contains a single fixed 32-byte field:
/* include/uapi/linux/if_link.h */
struct ifla_vf_broadcast {
__u8 broadcast[32];
};
The function then copies dev->broadcast into it using dev->addr_len
as the length:
memcpy(vf_broadcast.broadcast, dev->broadcast, dev->addr_len);
On Ethernet devices (the overwhelming majority of SR-IOV NICs)
dev->addr_len is 6, so only the first 6 bytes of broadcast[] are
written. The remaining 26 bytes retain whatever was previously on
the kernel stack. The full struct is then handed to userspace via:
nla_put(skb, IFLA_VF_BROADCAST,
sizeof(vf_broadcast), &vf_broadcast)
leaking up to 26 bytes of uninitialised kernel stack per VF per
RTM_GETLINK request, repeatable.
The other vf_* structs in the same function are explicitly zeroed
for exactly this reason - see the memset() calls for ivi,
vf_vlan_info, node_guid and port_guid a few lines above.
vf_broadcast was simply missed when it was added.
Reachability: any unprivileged local process can open AF_NETLINK /
NETLINK_ROUTE without capabilities and send RTM_GETLINK with an
IFLA_EXT_MASK attribute carrying RTEXT_FILTER_VF. The kernel walks
each VF and emits IFLA_VF_BROADCAST, leaking 26 bytes of stack per
VF per request. Stack residue at this call site can include return
addresses and transient sensitive data; KASAN with stack
instrumentation, or KMSAN, will flag the nla_put() when reproduced.
Zero the on-stack struct before the partial memcpy, matching the
existing pattern used for the other vf_* structs in the same
function.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 75345f888f700c4ab2448287e35d48c760b202e6 < 14271b401ec6a4bf0d88054106fc2956084717e1 | 14271b401ec6a4bf0d88054106fc2956084717e1 |
| linux | linux | >= 75345f888f700c4ab2448287e35d48c760b202e6 < cccce3190ba4356432b9f22369b56123d3d89f0d | cccce3190ba4356432b9f22369b56123d3d89f0d |
| linux | linux | >= 75345f888f700c4ab2448287e35d48c760b202e6 < a44fbb631cba646532f3948636626f81717365a7 | a44fbb631cba646532f3948636626f81717365a7 |
| linux | linux | >= 75345f888f700c4ab2448287e35d48c760b202e6 < 0653c0516234c8258975d268a749115fc0f0ff00 | 0653c0516234c8258975d268a749115fc0f0ff00 |
| linux | linux | >= 75345f888f700c4ab2448287e35d48c760b202e6 < c5b1b92ab7eff1a6e8c507ddde6fd02fabd0cfa8 | c5b1b92ab7eff1a6e8c507ddde6fd02fabd0cfa8 |
| linux | linux | >= 75345f888f700c4ab2448287e35d48c760b202e6 < fbe0e6197225e6a83cf113a67a4b425f8de0bcd5 | fbe0e6197225e6a83cf113a67a4b425f8de0bcd5 |
| linux | linux | >= 75345f888f700c4ab2448287e35d48c760b202e6 < 38bcc21f52246badb3154b6158dcb381d98de011 | 38bcc21f52246badb3154b6158dcb381d98de011 |
| linux | linux | >= 75345f888f700c4ab2448287e35d48c760b202e6 < 4b9e327991815e128ad3af75c3a04630a63ce3e0 | 4b9e327991815e128ad3af75c3a04630a63ce3e0 |
| linux | linux_kernel | — | — |