What’s Vulnerable › Vulnerabilities

CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-27 · updated 2026-06-25

Description

In the Linux kernel, the following vulnerability has been resolved: net: mctp: ensure our nlmsg responses are initialised Syed Faraz Abrar (@farazsth98) from Zellic, and Pumpkin (@u1f383) from DEVCORE Research Team working with Trend Micro Zero Day Initiative report that a RTM_GETNEIGH will return uninitalised data in the pad bytes of the ndmsg data. Ensure we're initialising the netlink data to zero, in the link, addr and neigh response messages.

Affected products

• Linux kernel: from 5.15 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.93; from 6.13 before 6.18.35; from 6.19 before 6.19.4 — fixed in 5.15.210, 6.1.176, 6.12.93, 6.18.35, 6.19.4, 6.6.143

How to fix

Upgrade to a fixed version: Linux kernel 5.15.210, 6.1.176, 6.12.93, 6.18.35. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/54ed418de62a148a655262da682a050fa05f7924
• https://git.kernel.org/stable/c/6fb6a97c86abb8592158088afaea0eb464cf9de1
• https://git.kernel.org/stable/c/963537a26fd892f7e414a091f807b44aeee97a7d
• https://git.kernel.org/stable/c/976612471a9e6ead6ceffc241e4d0a1aac90b36a
• https://git.kernel.org/stable/c/a6a9bc544b675d8b5180f2718ec985ad267b5cbf
• https://git.kernel.org/stable/c/b37da3ac099e145bcd3be82c745a8d335772e3af
• https://git.kernel.org/stable/c/c4f840437e7641764de15f2de951ac8335d641f1

Get alerted when CVE-2026-45930 or the next vulnerability affects your stack