Not yet scoredPublished Aug 15, 2026

CVE-2026-72441ieee802154: fix kernel-infoleak in dgram_recvmsg()

Updated under an hour ago (Oct 27, 2026, 5:20 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgram_recvmsg() KMSAN reported a kernel-infoleak in move_addr_to_user(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:131 [inline] BUG: KMSAN: kernel-infoleak in _inline_copy_to_user include/linux/uaccess.h:205 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 lib/usercopy.c:26 instrument_copy_to_user include/linux/instrumented.h:131 [inline] _inline_copy_to_user include/linux/uaccess.h:205 [inline] _copy_to_user+0xcc/0x120 lib/usercopy.c:26 copy_to_user include/linux/uaccess.h:236 [inline] move_addr_to_user+0x2e7/0x440 net/socket.c:302 ____sys_recvmsg+0x232/0x610 net/socket.c:2925 ... Uninit was stored to memory at: ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline] dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739 The issue occurs because the `pan_id` field of `struct ieee802154_addr` is left uninitialized when the address mode is `IEEE802154_ADDR_NONE`. The execution flow is as follows: 1. `__ieee802154_rx_handle_packet()` declares a local `struct ieee802154_hdr hdr` on the stack. 2. `ieee802154_hdr_pull()` calls `ieee802154_hdr_get_addr()` to parse the source and destination addresses into this structure. 3. If the address mode is `IEEE802154_ADDR_NONE`, `ieee802154_hdr_get_addr()` previously only set the `mode` field, leaving the `pan_id` field containing uninitialized stack memory. 4. This uninitialized `pan_id` is later copied into a `struct sockaddr_ieee802154` in `dgram_recvmsg()` via `ieee802154_addr_to_sa()`. 5. Finally, `move_addr_to_user()` copies the socket address structure to user space, leaking the uninitialized bytes. Fix this by using `memset` to zero out the address structure in `ieee802154_hdr_get_addr()` when the mode is `IEEE802154_ADDR_NONE`.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 94b4f6c21cf54029377a0645675a9d81b6cf890d before a2ee1a038a16e286d084bc293a7522d010a59ec3; 94b4f6c21cf54029377a0645675a9d81b6cf890d builds before 09cfe665f2c5d7a8a5ed4d6b487434a011325368; from 94b4f6c21cf54029377a0645675a9d81b6cf890d before c88e687e44cb9c7690f5039a5a5941dba1f6a204; 94b4f6c21cf54029377a0645675a9d81b6cf890d builds before 71b5add66c51d6764325de5f2e300bbf4f39e7a6; from 94b4f6c21cf54029377a0645675a9d81b6cf890d before fc8766467b53335220b4b594ba15bc8f8cee0c76; from 94b4f6c21cf54029377a0645675a9d81b6cf890d before de3bd9809af7555611334cb6a071806744430ef7; from 94b4f6c21cf54029377a0645675a9d81b6cf890d before f14802465f5956baafe5f4b4541eb626b06b41f1; 94b4f6c21cf54029377a0645675a9d81b6cf890d builds before 4db86f8ab11b5a41bfc36680be837e6ac1375ec6	CNA record

References

References

https://git.kernel.org/stable/c/a2ee1a038a16e286d084bc293a7522d010a59ec3
https://git.kernel.org/stable/c/09cfe665f2c5d7a8a5ed4d6b487434a011325368
https://git.kernel.org/stable/c/c88e687e44cb9c7690f5039a5a5941dba1f6a204
https://git.kernel.org/stable/c/71b5add66c51d6764325de5f2e300bbf4f39e7a6
https://git.kernel.org/stable/c/fc8766467b53335220b4b594ba15bc8f8cee0c76
https://git.kernel.org/stable/c/de3bd9809af7555611334cb6a071806744430ef7
https://git.kernel.org/stable/c/f14802465f5956baafe5f4b4541eb626b06b41f1
https://git.kernel.org/stable/c/4db86f8ab11b5a41bfc36680be837e6ac1375ec6

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.