---
id: CVE-2026-74577
title: 'net: mpls: initialize rtm_tos in mpls_getroute()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: mpls: initialize rtm_tos in mpls_getroute()

  mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE
  request by filling a struct rtmsg allocated from an s…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 <
    248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1
  - >-
    Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 <
    466b474a8deb0c93b5280c6d261e5eda6482eca7
  - >-
    Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 <
    ba56f88aab18d982f2a21f11390f4d8a8897782a
  - >-
    Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 <
    95651461cf77cc6590fa08c87667717e5dcfa55d
  - >-
    Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 <
    1fea5ff0eb4aa7e951bb3d380248566c473aa377
  - >-
    Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 <
    a5cdd2407dd890f741f59b8367e4c6c101cce154
  - >-
    Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 <
    2dc2fffc704a4365cae1aae078ba62223aaeff93
  - >-
    Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 <
    295dd295e2137e10e9a5b1891d97e0f08de76f03
  - Linux 4.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:59:42.740510Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:48.538Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74577'
references:
  - url: 'https://git.kernel.org/stable/c/248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1'
  - url: 'https://git.kernel.org/stable/c/466b474a8deb0c93b5280c6d261e5eda6482eca7'
  - url: 'https://git.kernel.org/stable/c/ba56f88aab18d982f2a21f11390f4d8a8897782a'
  - url: 'https://git.kernel.org/stable/c/95651461cf77cc6590fa08c87667717e5dcfa55d'
  - url: 'https://git.kernel.org/stable/c/1fea5ff0eb4aa7e951bb3d380248566c473aa377'
  - url: 'https://git.kernel.org/stable/c/a5cdd2407dd890f741f59b8367e4c6c101cce154'
  - url: 'https://git.kernel.org/stable/c/2dc2fffc704a4365cae1aae078ba62223aaeff93'
  - url: 'https://git.kernel.org/stable/c/295dd295e2137e10e9a5b1891d97e0f08de76f03'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.05778
ingestedAt: '2026-11-06T18:00:12.546Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: mpls: initialize rtm_tos in mpls_getroute()

mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE
request by filling a struct rtmsg allocated from an skb whose data
area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every
field of the header except rtm_tos:

	r = nlmsg_data(nlh);
	r->rtm_family	 = AF_MPLS;
	r->rtm_dst_len	= 20;
	r->rtm_src_len	= 0;
	r->rtm_table	= RT_TABLE_MAIN;
	r->rtm_type	= RTN_UNICAST;
	r->rtm_scope	= RT_SCOPE_UNIVERSE;
	r->rtm_protocol = rt->rt_protocol;
	r->rtm_flags	= 0;

struct rtmsg has no padding, so the one uninitialised byte rtm_tos
(offset 3) is copied straight to user space on recvmsg(), leaking a
byte of uninitialised heap memory. This is in contrast to
mpls_dump_route(), which fills the very same header and does set
rtm_tos = 0.

Initialize rtm_tos to 0, matching mpls_dump_route().

Reproduced with KMSAN by adding an MPLS route and issuing a
non-RTM_F_FIB_MATCH RTM_GETROUTE for its label:

  BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0
   _copy_to_iter+0x36c/0x33f0
   __skb_datagram_iter+0x196/0x12c0
   skb_copy_datagram_iter+0x5b/0x210
   netlink_recvmsg+0x37b/0xef0
   ...
  Uninit was created at:
   __alloc_skb+0x8ca/0x10e0
   mpls_getroute+0x1280/0x3a40
   rtnetlink_rcv_msg+0x1138/0x15a0
   ...
  Byte 19 of 64 is uninitialized

(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)

## Affected

- `Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 < 248718fd88b146d8bdc7610ecd1eb4cd16e0b5a1`
- `Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 < 466b474a8deb0c93b5280c6d261e5eda6482eca7`
- `Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 < ba56f88aab18d982f2a21f11390f4d8a8897782a`
- `Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 < 95651461cf77cc6590fa08c87667717e5dcfa55d`
- `Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 < 1fea5ff0eb4aa7e951bb3d380248566c473aa377`
- `Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 < a5cdd2407dd890f741f59b8367e4c6c101cce154`
- `Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 < 2dc2fffc704a4365cae1aae078ba62223aaeff93`
- `Linux >= 397fc9e5cefee0c33b86811fbddb0decb7288c52 < 295dd295e2137e10e9a5b1891d97e0f08de76f03`
- `Linux 4.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.