Homepage

CVE-2026-74577 Affecting kernel-uek-debug-modules-deprecated package, versions <0:6.12.0-206.104.3.3.el10uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.17% (7th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE10-KERNELUEKDEBUGMODULESDEPRECATED-19614365
  • published5 Sept 2026
  • disclosed15 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 15 Aug 2026

NewCVE-2026-74577  (opens in a new tab)

How to fix?

Upgrade Oracle:10 kernel-uek-debug-modules-deprecated to version 0:6.12.0-206.104.3.3.el10uek or higher.
This issue was patched in ELSA-2026-500248.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-debug-modules-deprecated package and not the kernel-uek-debug-modules-deprecated package as distributed by Oracle. See How to fix? for Oracle:10 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

net: mpls: initialize rtm_tos in mpls_getroute()

mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb(NLMSG_GOODSIZE, ...)). It sets every field of the header except rtm_tos:

r = nlmsg_data(nlh);
r-&gt;rtm_family	 = AF_MPLS;
r-&gt;rtm_dst_len	= 20;
r-&gt;rtm_src_len	= 0;
r-&gt;rtm_table	= RT_TABLE_MAIN;
r-&gt;rtm_type	= RTN_UNICAST;
r-&gt;rtm_scope	= RT_SCOPE_UNIVERSE;
r-&gt;rtm_protocol = rt-&gt;rt_protocol;
r-&gt;rtm_flags	= 0;

struct rtmsg has no padding, so the one uninitialised byte rtm_tos (offset 3) is copied straight to user space on recvmsg(), leaking a byte of uninitialised heap memory. This is in contrast to mpls_dump_route(), which fills the very same header and does set rtm_tos = 0.

Initialize rtm_tos to 0, matching mpls_dump_route().

Reproduced with KMSAN by adding an MPLS route and issuing a non-RTM_F_FIB_MATCH RTM_GETROUTE for its label:

BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x36c/0x33f0 _copy_to_iter+0x36c/0x33f0 __skb_datagram_iter+0x196/0x12c0 skb_copy_datagram_iter+0x5b/0x210 netlink_recvmsg+0x37b/0xef0 ... Uninit was created at: __alloc_skb+0x8ca/0x10e0 mpls_getroute+0x1280/0x3a40 rtnetlink_rcv_msg+0x1138/0x15a0 ... Byte 19 of 64 is uninitialized

(byte 19 = nlmsghdr(16) + rtmsg offset 3 = rtm_tos)

CVSS Base Scores

version 3.1