SB20260507155 - Improper Initialization in Linux kernel block rnbd driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260507155

SB20260507155 - Improper Initialization in Linux kernel block rnbd driver

Published: May 7, 2026

Security Bulletin ID SB20260507155
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Initialization (CVE-ID: CVE-2026-43184)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper initialization in rnbd-srv response buffer handling when exchanging response messages between different protocol versions. A remote attacker can trigger communication using mismatched protocol versions to disclose sensitive information.

The issue arises because stray bytes in the response buffer may be picked up by the client side.


Remediation

Install update from vendor's website.

References