Information Leak in Linux Kernel's Networking Stack

CVE-2025-40278

What is CVE-2025-40278?

A vulnerability in the Linux Kernel's networking stack involved a kernel information leak due to uninitialized padding bytes in a data structure. The variable used in the netlink message was only partially initialized, leading to the potential exposure of sensitive kernel memory data to userspace. This issue has been identified and addressed by ensuring that all members, including padding bytes of the structure, are completely zeroed before further processing. The fix has passed validation to prevent such information leaks in the future.

References