CVE-2026-72441
Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg() KMSAN reported a kernel-infoleak in move_addr_to_user(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:131 [inline] BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:205 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26 instrument_copy_to_user include/linux/instrumented.h:131 [inline] _inline_copy_to_user include/linux/uaccess.h:205 [inline] _copy_to_user+0xcc/0x120 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:236 [inline] move_addr_to_user+0x2e7/0x440 net/socket.c:302 ____sys_recvmsg+0x232/0x610 net/socket.c:2925 ... Uninit was stored to memory at: ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline] dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739 The issue occurs because the `pan_id` field of `struct ieee802154_addr` is left uninitialized when the address mode is `IEEE802154_ADDR_NONE`. The execution flow is as follows: 1. `__ieee802154_rx_handle_packet()` declares a local `struct ieee802154_hdr hdr` on the stack. 2. `ieee802154_hdr_pull()` calls `ieee802154_hdr_get_addr()` to parse the source and destination addresses into this structure. 3. If the address mode is `IEEE802154_ADDR_NONE`, `ieee802154_hdr_get_addr()` previously only set the `mode` field, leaving the `pan_id` field containing uninitialized stack memory. 4. This uninitialized `pan_id` is later copied into a `struct sockaddr_ieee802154` in `dgram_recvmsg()` via `ieee802154_addr_to_sa()`. 5. Finally, `move_addr_to_user()` copies the socket address structure to user space, leaking the uninitialized bytes. Fix this by using `memset` to zero out the address structure in `ieee802154_hdr_get_addr()` when the mode is `IEEE802154_ADDR_NONE`.
How to fix
- Linux Linuxa2ee1a038a16e286d084bc293a7522d010a59ec3, 09cfe665f2c5d7a8a5ed4d6b487434a011325368, c88e687e44cb9c7690f5039a5a5941dba1f6a204, 71b5add66c51d6764325de5f2e300bbf4f39e7a6, fc8766467b53335220b4b594ba15bc8f8cee0c76, de3bd9809af7555611334cb6a071806744430ef7, f14802465f5956baafe5f4b4541eb626b06b41f1, 4db86f8ab11b5a41bfc36680be837e6ac1375ec6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 94b4f6c21cf54029377a0645675a9d81b6cf890d ≤ v < a2ee1a038a16e286d084bc293a7522d010a59ec3, 94b4f6c21cf54029377a0645675a9d81b6cf890d ≤ v < 09cfe665f2c5d7a8a5ed4d6b487434a011325368, 94b4f6c21cf54029377a0645675a9d81b6cf890d ≤ v < c88e687e44cb9c7690f5039a5a5941dba1f6a204, 94b4f6c21cf54029377a0645675a9d81b6cf890d ≤ v < 71b5add66c51d6764325de5f2e300bbf4f39e7a6, 94b4f6c21cf54029377a0645675a9d81b6cf890d ≤ v < fc8766467b53335220b4b594ba15bc8f8cee0c76, 94b4f6c21cf54029377a0645675a9d81b6cf890d ≤ v < de3bd9809af7555611334cb6a071806744430ef7, 94b4f6c21cf54029377a0645675a9d81b6cf890d ≤ v < f14802465f5956baafe5f4b4541eb626b06b41f1, 94b4f6c21cf54029377a0645675a9d81b6cf890d ≤ v < 4db86f8ab11b5a41bfc36680be837e6ac1375ec6, 3.15 | a2ee1a038a16e286d084bc293a7522d010a59ec3, 09cfe665f2c5d7a8a5ed4d6b487434a011325368, c88e687e44cb9c7690f5039a5a5941dba1f6a204, 71b5add66c51d6764325de5f2e300bbf4f39e7a6, fc8766467b53335220b4b594ba15bc8f8cee0c76, de3bd9809af7555611334cb6a071806744430ef7, f14802465f5956baafe5f4b4541eb626b06b41f1, 4db86f8ab11b5a41bfc36680be837e6ac1375ec6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.