SB20261023243 - Use of uninitialized resource in Linux kernel net driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-98929)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a kernel warning and cause MACsec registration notifications to report uninitialized security attributes.

The vulnerability exists due to use of an uninitialized resource in the Linux kernel MACsec driver when network device registration generates notifications before the security entity (SecY) is initialized. A local privileged user can create a MACsec device to cause notifications to report uninitialized SecY attributes, including the secure channel identifier (SCI). Creating the device with MAC offload over an LRO-capable lower device while IPv4 forwarding is enabled by default also triggers a warning in rtmsg_ifinfo_build_skb(), because macsec_fill_info() encounters a zero key_len and returns -EMSGSIZE.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2b42adf3b8ee9a0e1d2629aca3c5a02a1c438066
• https://git.kernel.org/stable/c/b07bea42bf590edb0fd507ab25622a74af09548b
• https://git.kernel.org/stable/c/c2de369c5c5b8599ca10fd5ca8d11fcd845c1331