SB2026102964 - Use of uninitialized resource in Linux kernel netlink

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-99211)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel memory from socket buffer headroom.

The vulnerability exists due to the use of uninitialized memory in Linux kernel netlink socket filtering when processing messages whose network and MAC header offsets have not been reset after reserving headroom. A local user can attach a classic socket filter to an unprivileged NETLINK_RDMA socket and use SKF_NET_OFF or SKF_LL_OFF to read before the initialized IWPM HELLO reply, disclosing headroom data through the length of the delivered reply.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d
• https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47
• https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0