{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: mpls: initialize rtm_tos in mpls_getroute()  mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every field of the header except rtm_tos:  \tr = nlmsg_data(nlh); \tr-\u003ertm_family\t = AF_MPLS; \tr-\u003ertm_dst_len\t= 20; \tr-\u003ertm_src_len\t= 0; \tr-\u003ertm_table\t= RT_TABLE_MAIN; \tr-\u003ertm_type\t= RTN_UNICAST; \tr-\u003ertm_scope\t= RT_SCOPE_UNIVERSE; \tr-\u003ertm_protocol = rt-\u003ert_protocol; \tr-\u003ertm_flags\t= 0;  struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mpls_dump_route(), which fills the very same header and does set rtm_tos = 0.  Initialize rtm_tos to 0, matching mpls_dump_route().  Reproduced with KMSAN by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label:    BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0    _copy_to_iter+0x36c/0x33f0    __skb_datagram_iter+0x196/0x12c0    skb_copy_datagram_iter+0x5b/0x210    netlink_recvmsg+0x37b/0xef0    ...   Uninit was created at:    __alloc_skb+0x8ca/0x10e0    mpls_getroute+0x1280/0x3a40    rtnetlink_rcv_msg+0x1138/0x15a0    ...   Byte 19 of 64 is uninitialized  (byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)",
  "id": "DEBIAN-CVE-2026-74577",
  "modified": "2026-09-19T21:47:30.837791561Z",
  "published": "2026-08-15T13:18:03.430Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74577"
    }
  ],
  "upstream": [
    "CVE-2026-74577"
  ]
}