Memory Leak Vulnerability in Linux Kernel Affecting Network Functionality

CVE-2026-74577

What is CVE-2026-74577?

A vulnerability in the Linux kernel has been identified, where the mpls_getroute() function fails to initialize the traffic class field (rtm_tos) of the route message. This oversight can lead to the leakage of uninitialized heap memory to user space when handling RTM_GETROUTE requests. The vulnerability manifests when an MPLS route is added and consequently queried, potentially exposing sensitive data. Proper initialization of rtm_tos to zero is implemented in a more secure function (mpls_dump_route) but was omitted in mpls_getroute, highlighting a critical gap in memory management that can be exploited by malicious actors.

References