Use of uninitialized resource in Linux kernel - CVE-2026-99211

Vulnerability details

The vulnerability allows a local user to disclose uninitialized kernel memory from socket buffer headroom.

The vulnerability exists due to the use of uninitialized memory in Linux kernel netlink socket filtering when processing messages whose network and MAC header offsets have not been reset after reserving headroom. A local user can attach a classic socket filter to an unprivileged NETLINK_RDMA socket and use SKF_NET_OFF or SKF_LL_OFF to read before the initialized IWPM HELLO reply, disclosing headroom data through the length of the delivered reply.

Affected software

How to mitigate CVE-2026-99211

External References

• https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d
• https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47
• https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0

Related Security Bulletins

• Use of uninitialized resource in Linux kernel netlink
• Debian update for linux