ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability
ZDI discloses Linux Kernel MCTP routing uninitialized memory flaw (CVE-2026-45930) letting high-privileged local attackers leak sensitive kernel information.
ZDI-26-690 describes an uninitialized memory information disclosure vulnerability in the Linux Kernel MCTP routing subsystem, tracked as CVE-2026-45930 with a CVSS rating of 6.0. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.
- CVE-2026-45930, CVSS 6.0, affects Linux Kernel MCTP routing
- Uninitialized memory read exposes sensitive information locally
- Requires pre-existing high-privileged code execution, limiting practical impact
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-45930 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: net: mctp: ensure our nlmsg responses are initialised Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from DEVCORE Research Team working with Trend Micro Zero Day Initiative report that a RTM_GETNEIGH will return uninitalised data in the pad bytes of the ndmsg data. Ensure we're initialising the netlink data to zero, in the link, addr and neigh response messages. NVD description · AI analysis pending | 5.5 | <1% |
| — |
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2026-45930.
This source does not provide full text. Read it at zerodayinitiative.com.