In the Linux kernel, the following vulnerability has been resolved:

ieee802154: fix kernel-infoleak in dgram_recvmsg()

KMSAN reported a kernel-infoleak in move_addr_to_user():

BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/linux/instrumented.h:131 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user
include/linux/uaccess.h:205 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120
lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:131 [inline]
_inline_copy_to_user include/linux/uaccess.h:205 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:236 [inline]
move_addr_to_user+0x2e7/0x440 net/socket.c:302
____sys_recvmsg+0x232/0x610 net/socket.c:2925
...
Uninit was stored to memory at:
ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline]
dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739

The issue occurs because the `pan_id` field of `struct ieee802154_addr`
is left uninitialized when the address mode is `IEEE802154_ADDR_NONE`.
The execution flow is as follows:

1. `__ieee802154_rx_handle_packet()` declares a local `struct
ieee802154_hdr hdr` on the stack.
2. `ieee802154_hdr_pull()` calls `ieee802154_hdr_get_addr()` to parse
the source and destination addresses into this structure.
3. If the address mode is `IEEE802154_ADDR_NONE`,
`ieee802154_hdr_get_addr()` previously only set the `mode` field,
leaving the `pan_id` field containing uninitialized stack memory.
4. This uninitialized `pan_id` is later copied into a `struct
sockaddr_ieee802154` in `dgram_recvmsg()` via `ieee802154_addr_to_sa()`.
5. Finally, `move_addr_to_user()` copies the socket address structure to
user space, leaking the uninitialized bytes.

Fix this by using `memset` to zero out the address structure in
`ieee802154_hdr_get_addr()` when the mode is `IEEE802154_ADDR_NONE`.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00236.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
94b4f6c21cf54029377a0645675a9d81b6cf890d affected < a2ee1a038a16e286d084bc293a7522d010a59ec3
94b4f6c21cf54029377a0645675a9d81b6cf890d affected < 09cfe665f2c5d7a8a5ed4d6b487434a011325368
94b4f6c21cf54029377a0645675a9d81b6cf890d affected < c88e687e44cb9c7690f5039a5a5941dba1f6a204
94b4f6c21cf54029377a0645675a9d81b6cf890d affected < 71b5add66c51d6764325de5f2e300bbf4f39e7a6
94b4f6c21cf54029377a0645675a9d81b6cf890d affected < fc8766467b53335220b4b594ba15bc8f8cee0c76
94b4f6c21cf54029377a0645675a9d81b6cf890d affected < de3bd9809af7555611334cb6a071806744430ef7
94b4f6c21cf54029377a0645675a9d81b6cf890d affected < f14802465f5956baafe5f4b4541eb626b06b41f1
94b4f6c21cf54029377a0645675a9d81b6cf890d affected < 4db86f8ab11b5a41bfc36680be837e6ac1375ec6
Linux Linux affected
Version Status Constraints
3.15 affected —
0 unaffected < 3.15
5.10.261 unaffected ≤ 5.10.*
5.15.212 unaffected ≤ 5.15.*
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/09cfe665f2c5d7a8a5ed4d6b487434a011325368 cve-icon cve-icon
https://git.kernel.org/stable/c/4db86f8ab11b5a41bfc36680be837e6ac1375ec6 cve-icon cve-icon
https://git.kernel.org/stable/c/71b5add66c51d6764325de5f2e300bbf4f39e7a6 cve-icon cve-icon
https://git.kernel.org/stable/c/a2ee1a038a16e286d084bc293a7522d010a59ec3 cve-icon cve-icon
https://git.kernel.org/stable/c/c88e687e44cb9c7690f5039a5a5941dba1f6a204 cve-icon cve-icon
https://git.kernel.org/stable/c/de3bd9809af7555611334cb6a071806744430ef7 cve-icon cve-icon
https://git.kernel.org/stable/c/f14802465f5956baafe5f4b4541eb626b06b41f1 cve-icon cve-icon
https://git.kernel.org/stable/c/fc8766467b53335220b4b594ba15bc8f8cee0c76 cve-icon cve-icon
History

Sat, 15 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg() KMSAN reported a kernel-infoleak in move_addr_to_user(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:131 [inline] BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:205 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26 instrument_copy_to_user include/linux/instrumented.h:131 [inline] _inline_copy_to_user include/linux/uaccess.h:205 [inline] _copy_to_user+0xcc/0x120 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:236 [inline] move_addr_to_user+0x2e7/0x440 net/socket.c:302 ____sys_recvmsg+0x232/0x610 net/socket.c:2925 ... Uninit was stored to memory at: ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline] dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739 The issue occurs because the `pan_id` field of `struct ieee802154_addr` is left uninitialized when the address mode is `IEEE802154_ADDR_NONE`. The execution flow is as follows: 1. `__ieee802154_rx_handle_packet()` declares a local `struct ieee802154_hdr hdr` on the stack. 2. `ieee802154_hdr_pull()` calls `ieee802154_hdr_get_addr()` to parse the source and destination addresses into this structure. 3. If the address mode is `IEEE802154_ADDR_NONE`, `ieee802154_hdr_get_addr()` previously only set the `mode` field, leaving the `pan_id` field containing uninitialized stack memory. 4. This uninitialized `pan_id` is later copied into a `struct sockaddr_ieee802154` in `dgram_recvmsg()` via `ieee802154_addr_to_sa()`. 5. Finally, `move_addr_to_user()` copies the socket address structure to user space, leaking the uninitialized bytes. Fix this by using `memset` to zero out the address structure in `ieee802154_hdr_get_addr()` when the mode is `IEEE802154_ADDR_NONE`.
Title ieee802154: fix kernel-infoleak in dgram_recvmsg()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:56:53.305Z

Reserved: 2026-08-09T03:40:39.930Z

Link: CVE-2026-72441

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:17.937

Modified: 2026-08-15T06:22:17.937

Link: CVE-2026-72441

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T18:00:11Z

Weaknesses