Information Leak in Linux Kernel Due to Uninitialized Field in Netlink Messages

CVE-2026-43035

What is CVE-2026-43035?

A vulnerability exists in the Linux Kernel pertaining to netlink message handling within the tc_chain_fill_node function. This function fails to initialize the tcm_info field of the struct tcmsg, which can lead to the exposure of uninitialized memory. Consequently, sensitive kernel heap memory could inadvertently be leaked to userspace, potentially allowing unauthorized access to critical information. The issue has been addressed by ensuring that the tcm_info field is correctly zeroed during initialization, aligning it with the existing initialization routine for other fields.

References