UnratedFix available
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data The fix is simple, just zeroes the padding fields.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.253, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134
- CVEs
- CVE-2026-43040
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:08 UTC · Revision 1
Source evidence
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
core-osv · Original sourcePublished 1 May 2026, 14:15 UTC
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data The fix is simple, just zeroes the padding fields.
osv:CVE-2026-43040
Kernel
Fixed versions: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12
Complete source record
{
"id": "e235513be20ebfb72c2ab6f09e9b90ec74164d5e7bd213999d29a22186fbbcb2",
"url": "https://osv.dev/vulnerability/CVE-2026-43040",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak",
"summary": "In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data The fix is simple, just zeroes the padding fields.",
"evidence": "osv:CVE-2026-43040",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.253",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.203",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.168",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.134",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.81",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.22",
"evidence": "/affected/1/ranges"
},
{
"value": "6.19.12",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-43040",
"aliases": [
"CVE-2026-43040"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "31910575a9de61e78065e93846e8e7a4894a18bf"
},
{
"fixed": "1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c"
},
{
"fixed": "2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648"
},
{
"fixed": "11d7fe97421cfc81549940c20ed5ac9472d6db05"
},
{
"fixed": "7f56d87e527bb5a13c3e8b0d5840cb6332822f6d"
},
{
"fixed": "4f810c686fde509d1cdaa706322d9d2531f8f1a4"
},
{
"fixed": "b485eef3d97b7aae55ce669b6de555ec81f3d21c"
},
{
"fixed": "ef3645606e4a635d5062a492f22b7f490852ee67"
},
{
"fixed": "ae05340ccaa9d347fe85415609e075545bec589f"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43040.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.24"
},
{
"fixed": "5.10.253"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.203"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.168"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.134"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.81"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.22"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "6.19.12"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43040.json"
}
}
],
"modified": "2026-10-28T02:30:27.079356857Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
"https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
"https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
"https://git.kernel.org/stable/c/11d7fe97421cfc81549940c20ed5ac9472d6db05",
"https://git.kernel.org/stable/c/1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c",
"https://git.kernel.org/stable/c/2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648",
"https://git.kernel.org/stable/c/4f810c686fde509d1cdaa706322d9d2531f8f1a4",
"https://git.kernel.org/stable/c/7f56d87e527bb5a13c3e8b0d5840cb6332822f6d",
"https://git.kernel.org/stable/c/ae05340ccaa9d347fe85415609e075545bec589f",
"https://git.kernel.org/stable/c/b485eef3d97b7aae55ce669b6de555ec81f3d21c",
"https://git.kernel.org/stable/c/ef3645606e4a635d5062a492f22b7f490852ee67",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43040.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-43040",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43040.json"
}
},
"related_cves": [
{
"value": "CVE-2026-43040",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 493645,
"published_at": "2026-05-01T14:15:37.364+00:00"
}