ZDI-26-682: Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability
ZDI discloses an uninitialized-memory flaw in Linux kernel IPv6 neighbor discovery (CVE-2026-43040, CVSS 6.0) allowing information disclosure by already-privileged local attackers.
ZDI advisory ZDI-26-682 describes an uninitialized memory vulnerability in the Linux kernel's IPv6 Neighbour Discovery code, tracked as CVE-2026-43040 with a CVSS score of 6.0. Exploitation requires the attacker to already execute high-privileged code on the target, which severely limits practical impact to kernel memory information disclosure. No active exploitation is mentioned.
- Uninitialized memory in Linux kernel IPv6 Neighbour Discovery, CVE-2026-43040, CVSS 6.0
- Requires prior high-privileged local code execution, limiting real-world impact
- Impact limited to sensitive information disclosure
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-43040 | Linux kernel: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak | 7.1 | <1% |
From the original article
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.