CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: mpls: initialize rtm_tos in mpls_getroute()

mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE
request by filling a struct rtmsg allocated from an skb whose data
area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every
field of the header except rtm_tos:

	r = nlmsg_data(nlh);
	r->rtm_family	 = AF_MPLS;
	r->rtm_dst_len	= 20;
	r->rtm_src_len	= 0;
	r->rtm_table	= RT_TABLE_MAIN;
	r->rtm_type	= RTN_UNICAST;
	r->rtm_scope	= RT_SCOPE_UNIVERSE;
	r->rtm_protocol = rt->rt_protocol;
	r->rtm_flags	= 0;

struct rtmsg has no padding, so the one uninitialised byte rtm_tos
(offset 3) is copied straight to user space on recvmsg(), leaking a
byte of uninitialised heap memory. This is in contrast to
mpls_dump_route(), which fills the very same header and does set
rtm_tos = 0.

Initialize rtm_tos to 0, matching mpls_dump_route().

Reproduced with KMSAN by adding an MPLS route and issuing a
non-RTM_F_FIB_MATCH RTM_GETROUTE for its label:

  BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0
   _copy_to_iter+0x36c/0x33f0
   __skb_datagram_iter+0x196/0x12c0
   skb_copy_datagram_iter+0x5b/0x210
   netlink_recvmsg+0x37b/0xef0
   ...
  Uninit was created at:
   __alloc_skb+0x8ca/0x10e0
   mpls_getroute+0x1280/0x3a40
   rtnetlink_rcv_msg+0x1138/0x15a0
   ...
  Byte 19 of 64 is uninitialized

(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)

The Linux kernel CVE team has assigned CVE-2026-74577 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.13 with commit 397fc9e5cefee0c33b86811fbddb0decb7288c52 and fixed in 6.6.151 with commit 95651461cf77cc6590fa08c87667717e5dcfa55d
	Issue introduced in 4.13 with commit 397fc9e5cefee0c33b86811fbddb0decb7288c52 and fixed in 6.12.103 with commit 1fea5ff0eb4aa7e951bb3d380248566c473aa377
	Issue introduced in 4.13 with commit 397fc9e5cefee0c33b86811fbddb0decb7288c52 and fixed in 6.18.44 with commit a5cdd2407dd890f741f59b8367e4c6c101cce154
	Issue introduced in 4.13 with commit 397fc9e5cefee0c33b86811fbddb0decb7288c52 and fixed in 7.1.8 with commit 2dc2fffc704a4365cae1aae078ba62223aaeff93
	Issue introduced in 4.13 with commit 397fc9e5cefee0c33b86811fbddb0decb7288c52 and fixed in 7.2-rc6 with commit 295dd295e2137e10e9a5b1891d97e0f08de76f03

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74577
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mpls/af_mpls.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/95651461cf77cc6590fa08c87667717e5dcfa55d
	https://git.kernel.org/stable/c/1fea5ff0eb4aa7e951bb3d380248566c473aa377
	https://git.kernel.org/stable/c/a5cdd2407dd890f741f59b8367e4c6c101cce154
	https://git.kernel.org/stable/c/2dc2fffc704a4365cae1aae078ba62223aaeff93
	https://git.kernel.org/stable/c/295dd295e2137e10e9a5b1891d97e0f08de76f03