Linux Kernel Vulnerability in IPv6 Router Advertisement Processing

CVE-2026-43040

What is CVE-2026-43040?

A vulnerability has been identified in the Linux kernel’s handling of Router Advertisements (RA) with user options. This flaw arises when the kernel builds an RTM_NEWNDUSEROPT netlink message without properly zeroing out the padding fields in the nduseroptmsg struct. As a result, sensitive kernel data may be inadvertently leaked, posing a potential risk to system integrity. The introduced fix ensures that these padding fields are initialized to zero, effectively mitigating the risk of information disclosure during RA processing.

References