CVE-2026-43040: Linux Kernel IPv6 Info Leak Vulnerability

CVE-2026-43040 Overview

CVE-2026-43040 is an information disclosure vulnerability in the Linux kernel's IPv6 Neighbor Discovery (NDISC) subsystem. The flaw resides in the ndisc_ra_useropt function, which constructs RTM_NEWNDUSEROPT netlink messages when processing Router Advertisements containing user options. The nduseroptmsg struct contains three padding fields (nduseropt_padX) that are never zeroed before transmission. As a result, residual kernel memory contents can leak to user space through netlink subscribers. Maintainers resolved the issue by explicitly initializing the padding fields to zero before message dispatch.

Critical Impact
Local netlink listeners can read uninitialized kernel stack or heap bytes embedded in IPv6 router advertisement notifications, potentially exposing sensitive kernel data.

Affected Products

Linux kernel mainline (IPv6 NDISC subsystem in net/ipv6/ndisc.c)
Stable kernel branches receiving the backported fix across multiple commits
Linux distributions shipping affected kernel versions prior to the patch

Discovery Timeline

2026-05-01 - CVE-2026-43040 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-43040

Vulnerability Analysis

The vulnerability is a kernel memory information leak rooted in uninitialized structure padding. When the kernel receives an IPv6 Router Advertisement (RA) containing user options, the ndisc_ra_useropt function builds an RTM_NEWNDUSEROPT netlink notification. This notification is delivered to subscribers of the RTNLGRP_ND_USEROPT netlink multicast group.

The nduseroptmsg structure used in the message contains three padding fields named nduseropt_padX. These fields exist for alignment but were never explicitly initialized. Because the structure is allocated without zeroing, the padding bytes retain whatever data previously occupied that memory region. When the kernel transmits the netlink message, those uninitialized bytes are copied verbatim to user space.

The applied fix zeroes the padding fields before the message is sent, eliminating the leak channel. The vulnerability is classified as Information Exposure tied to Uninitialized Memory Use.

Root Cause

The root cause is missing explicit initialization of structure padding before the kernel hands a buffer to user-space-facing infrastructure. Compiler-inserted padding inside nduseroptmsg is not covered by field-by-field assignment, leaving residual stack or heap contents in those bytes.

Attack Vector

An attacker on the local network capable of sending crafted IPv6 Router Advertisements with user options can trigger the code path. A local user with permission to subscribe to the relevant netlink multicast group can then receive the resulting notifications and harvest leaked kernel memory bytes from the padding fields.

No code example is reproduced here. Refer to the upstream commits referenced below for the exact patch hunks and structure layout: Linux kernel commit 11d7fe97421c and commit ef3645606e4a.

Detection Methods for CVE-2026-43040

Indicators of Compromise

Unexpected IPv6 Router Advertisement traffic carrying user options from non-authorized routers on the local segment.
Local processes subscribing to the RTNLGRP_ND_USEROPT netlink multicast group without a clear operational reason.
Kernel package versions on managed Linux hosts that predate the upstream NDISC padding fix commits.

Detection Strategies

Audit installed kernel build identifiers against the fixed commit hashes referenced in the kernel.org stable tree to confirm patch presence.
Monitor for unusual AF_NETLINK socket consumers binding to routing groups, which is uncommon for non-network-management processes.
Inspect IPv6 RA traffic on monitored segments for unexpected user option (RDNSS, DNSSL, or similar) emitters.

Monitoring Recommendations

Forward kernel and package management logs to a centralized log platform to track kernel update status across the fleet.
Enable IPv6 RA Guard on managed switches to constrain which devices may emit Router Advertisements.
Track auditd events for processes opening netlink sockets and correlate with expected administrative tooling.

How to Mitigate CVE-2026-43040

Immediate Actions Required

Update Linux kernels to a stable release that includes the ndisc_ra_useropt padding initialization fix from the kernel.org stable tree.
Identify hosts on IPv6-enabled networks that are most exposed and prioritize patching there first.
Review which local processes subscribe to routing netlink multicast groups and restrict where feasible.

Patch Information

The upstream fix initializes the nduseropt_padX fields to zero before the RTM_NEWNDUSEROPT message is published. The change has been backported across multiple stable branches. Reference commits include 11d7fe97421c, 1da9023f6b07, 2fe4d0ba690a, 4f810c686fde, 7f56d87e527b, ae05340ccaa9, b485eef3d97b, and ef3645606e4a in the kernel.org stable tree.

Workarounds

Deploy IPv6 RA Guard at the network edge to drop Router Advertisements originating from untrusted hosts.
Restrict unprivileged user access to netlink multicast groups via container, namespace, or seccomp policies where applicable.
Disable IPv6 user option processing on hosts that do not require RDNSS or DNSSL functionality, when supported by the distribution.

bash

# Configuration example: enforce kernel update and verify version
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
uname -r
# Confirm running kernel includes the ndisc_ra_useropt padding fix from upstream stable