ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability
ZDI discloses Linux Kernel MCTP routing uninitialized memory flaw (CVE-2026-45930) letting high-privileged local attackers leak sensitive kernel information.
ZDI-26-690 describes an uninitialized memory information disclosure vulnerability in the Linux Kernel MCTP routing subsystem, tracked as CVE-2026-45930 with a CVSS rating of 6.0. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.
- CVE-2026-45930, CVSS 6.0, affects Linux Kernel MCTP routing
- Uninitialized memory read exposes sensitive information locally
- Requires pre-existing high-privileged code execution, limiting practical impact
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-45930 | Linux kernel: net: mctp: ensure our nlmsg responses are initialised Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin… | 5.5 | <1% |
From the original article
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.