CVE-2026-72441

CVE CVE-2026-72441EUVD EUVD-2026-59340Published 2026-08-15T05:56:53.000ZLast changed 2026-08-17T05:14:42.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg() KMSAN reported a kernel-infoleak in move_addr_to_user(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:131 [inline] BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:205 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26 instrument_copy_to_user include/linux/instrumented.h:131 [inline] _inline_copy_to_user include/linux/uaccess.h:205 [inline] _copy_to_user+0xcc/0x120 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:236 [inline] move_addr_to_user+0x2e7/0x440 net/socket.c:302 ____sys_recvmsg+0x232/0x610 net/socket.c:2925 ... Uninit was stored to memory at: ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline] dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739 The issue occurs because the `pan_id` field of `struct ieee802154_addr` is left uninitialized when the address mode is `IEEE802154_ADDR_NONE`. The execution flow is as follows: 1. `__ieee802154_rx_handle_packet()` declares a local `struct ieee802154_hdr hdr` on the stack. 2. `ieee802154_hdr_pull()` calls `ieee802154_hdr_get_addr()` to parse the source and destination addresses into this structure. 3. If the address mode is `IEEE802154_ADDR_NONE`, `ieee802154_hdr_get_addr()` previously only set the `mode` field, leaving the `pan_id` field containing uninitialized stack memory. 4. This uninitialized `pan_id` is later copied into a `struct sockaddr_ieee802154` in `dgram_recvmsg()` via `ieee802154_addr_to_sa()`. 5. Finally, `move_addr_to_user()` copies the socket address structure to user space, leaking the uninitialized bytes. Fix this by using `memset` to zero out the address structure in `ieee802154_hdr_get_addr()` when the mode is `IEEE802154_ADDR_NONE`.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 94b4f6c21cf54029377a0645675a9d81b6cf890d <09cfe665f2c5d7a8a5ed4d6b487434a011325368; 94b4f6c21cf54029377a0645675a9d81b6cf890d <c88e687e44cb9c7690f5039a5a5941dba1f6a204; patch: 5.10.261; 94b4f6c21cf54029377a0645675a9d81b6cf890d <de3bd9809af7555611334cb6a071806744430ef7; patch: 7.2; 94b4f6c21cf54029377a0645675a9d81b6cf890d <f14802465f5956baafe5f4b4541eb626b06b41f1; patch: 7.1.5; patch: 6.18.40; patch: 6.12.97; patch: 0; 3.15; patch: 6.6.145; patch: 6.1.178; patch: 5.15.212; 94b4f6c21cf54029377a0645675a9d81b6cf890d <fc8766467b53335220b4b594ba15bc8f8cee0c76; 94b4f6c21cf54029377a0645675a9d81b6cf890d <a2ee1a038a16e286d084bc293a7522d010a59ec3; 94b4f6c21cf54029377a0645675a9d81b6cf890d <71b5add66c51d6764325de5f2e300bbf4f39e7a6; 94b4f6c21cf54029377a0645675a9d81b6cf890d <4db86f8ab11b5a41bfc36680be837e6ac1375ec6

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.