CVE-2026-43040None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak When processing Router Advertisements with user options the …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data
The fix is simple, just zeroes the padding fields.
Linux >= 31910575a9de61e78065e93846e8e7a4894a18bf < 1da9023f6b071a38e5430ffbce4b70b2b1ac4f9cLinux >= 31910575a9de61e78065e93846e8e7a4894a18bf < 2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648Linux >= 31910575a9de61e78065e93846e8e7a4894a18bf < 11d7fe97421cfc81549940c20ed5ac9472d6db05Linux >= 31910575a9de61e78065e93846e8e7a4894a18bf < 7f56d87e527bb5a13c3e8b0d5840cb6332822f6dLinux >= 31910575a9de61e78065e93846e8e7a4894a18bf < 4f810c686fde509d1cdaa706322d9d2531f8f1a4Linux >= 31910575a9de61e78065e93846e8e7a4894a18bf < b485eef3d97b7aae55ce669b6de555ec81f3d21cLinux >= 31910575a9de61e78065e93846e8e7a4894a18bf < ef3645606e4a635d5062a492f22b7f490852ee67Linux >= 31910575a9de61e78065e93846e8e7a4894a18bf < ae05340ccaa9d347fe85415609e075545bec589fLinux 2.6.24Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74258High· 7.8In the Linux kernel, the following vulnerability has been resolved: bpf: Guard __get_user acesss with access_ok for uprobe_multi data As reported by sashiko [1] we need to use access_ok to check the user space data bounds before we use…
CVE-2026-74269Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA). It seems…
CVE-2026-74289High· 7.8In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). syzbot reported use-after-free in nsim_fib4_prepare_event()
CVE-2026-74291NoneIn the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays
CVE-2026-74294High· 7.3In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internal codec mux put callbacks use the written enum value with snd_soc_enum_item_to_val() before chec…
CVE-2026-74347High· 7.8In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nf_ct_timeout which is used by ct extension to set the custom ct…