CVE-2026-46132: Linux Kernel Information Disclosure Flaw

CVE-2026-46132 Overview

CVE-2026-46132 is a kernel stack information disclosure vulnerability in the Linux kernel rtnetlink subsystem. The rtnl_fill_vfinfo() function declares struct ifla_vf_broadcast on the stack without initialization, then copies only dev->addr_len bytes into its 32-byte broadcast[] field. On Ethernet devices, dev->addr_len is 6, leaving 26 bytes of uninitialized stack memory. The kernel then transmits the full struct to userspace via nla_put() with IFLA_VF_BROADCAST, leaking up to 26 bytes of kernel stack per virtual function per RTM_GETLINK request.

Critical Impact
Any unprivileged local process can repeatedly leak kernel stack residue including return addresses and transient sensitive data without requiring capabilities.

Affected Products

Linux kernel versions containing the rtnl_fill_vfinfo() implementation with uninitialized ifla_vf_broadcast
Systems running SR-IOV capable network interface cards (NICs)
Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-05-28 - CVE-2026-46132 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46132

Vulnerability Analysis

The vulnerability resides in rtnl_fill_vfinfo() within the Linux kernel's rtnetlink netlink interface. The function declares struct ifla_vf_broadcast vf_broadcast; on the stack with no initialization. The struct contains a single fixed 32-byte field __u8 broadcast[32] defined in include/uapi/linux/if_link.h.

The function then executes memcpy(vf_broadcast.broadcast, dev->broadcast, dev->addr_len). For Ethernet devices, dev->addr_len equals 6, so only the first 6 bytes of broadcast[] receive valid data. The remaining 26 bytes retain prior stack contents. The complete struct is then handed to userspace via nla_put(skb, IFLA_VF_BROADCAST, sizeof(vf_broadcast), &vf_broadcast).

Other vf_* structures in the same function are explicitly zeroed with memset() calls, including ivi, vf_vlan_info, node_guid, and port_guid. The vf_broadcast structure was overlooked when it was added, creating an Uninitialized Memory Use condition.

Root Cause

The root cause is a missing initialization of a stack-allocated structure before a partial memcpy() operation. The kernel emits the full sizeof(vf_broadcast) bytes to userspace even though only dev->addr_len bytes were written, exposing stack residue.

Attack Vector

Any unprivileged local process can open AF_NETLINK with the NETLINK_ROUTE family without requiring capabilities. The attacker sends an RTM_GETLINK message including an IFLA_EXT_MASK attribute carrying the RTEXT_FILTER_VF flag. The kernel iterates each VF and emits IFLA_VF_BROADCAST, leaking 26 bytes of stack per VF per request. The request is fully repeatable, allowing attackers to harvest stack residue containing return addresses, pointers useful for KASLR bypass, or transient sensitive data.

The vulnerability is described in detail in the upstream patch series. See Git Kernel Commit 4b9e327 and Git Kernel Commit fbe0e61 for the upstream resolution.

Detection Methods for CVE-2026-46132

Indicators of Compromise

Unexpected processes opening AF_NETLINK sockets with the NETLINK_ROUTE family and issuing repeated RTM_GETLINK requests with RTEXT_FILTER_VF set.
High-frequency netlink traffic from unprivileged user contexts on hosts with SR-IOV interfaces enabled.
KASAN or KMSAN warnings flagging nla_put() calls originating from rtnl_fill_vfinfo() when stack instrumentation is enabled.

Detection Strategies

Audit kernel build configurations for CONFIG_KASAN_STACK or KMSAN to surface uninitialized stack reads during testing.
Use eBPF or auditd rules to monitor for processes invoking netlink RTM_GETLINK operations with IFLA_EXT_MASK and RTEXT_FILTER_VF attributes.
Correlate netlink request volume with non-root process identities to identify enumeration patterns.

Monitoring Recommendations

Track kernel version inventory across SR-IOV hosts and flag systems missing the upstream fixes referenced in the kernel commits.
Alert on anomalous netlink socket activity from unprivileged accounts on hypervisors and bare-metal NIC servers.
Capture telemetry on netlink message sizes and IFLA_VF_* attribute usage for forensic baselines.

How to Mitigate CVE-2026-46132

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the technical references and reboot affected systems.
Inventory hosts with SR-IOV NICs and prioritize patching for systems exposing unprivileged user shells or container workloads.
Restrict local shell access on multi-tenant hosts until patched kernels are deployed.

Patch Information

The fix zeroes the on-stack vf_broadcast struct before the partial memcpy(), matching the existing pattern used for the other vf_* structs in the same function. The upstream resolution is available in the following commits: Git Kernel Commit 0653c05, Git Kernel Commit 38bcc21, Git Kernel Commit 4b9e327, Git Kernel Commit c5b1b92, and Git Kernel Commit fbe0e61.

Workarounds

Disable SR-IOV on affected interfaces where virtual function exposure is not required, reducing the number of VFs that emit IFLA_VF_BROADCAST data.
Restrict access to unprivileged local accounts on hosts running affected kernels until patches can be applied.
Apply seccomp or namespace restrictions that limit container workloads from opening NETLINK_ROUTE sockets where feasible.

bash

# Check current kernel version and SR-IOV exposure
uname -r
for dev in /sys/class/net/*/device/sriov_numvfs; do
  [ -f "$dev" ] && echo "$dev: $(cat $dev)"
done

# Temporarily disable SR-IOV VFs on an interface (example)
echo 0 | sudo tee /sys/class/net/eth0/device/sriov_numvfs