CVE-2026-43040
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak When processing Router Advertisements with user options the kernel builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct has three padding fields that are never zeroed and can leak kernel data The fix is simple, just zeroes the padding fields.
Severity
HIGH
CVSS score
7.1
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-05-01 15:16:50.130000
Last modified
2026-11-06 16:18:18.413000
View original CVE JSON
{
"id": "CVE-2026-43040",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-05-01T15:16:50.130",
"lastModified": "2026-11-06T16:18:18.413",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak\n\nWhen processing Router Advertisements with user options the kernel\nbuilds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct\nhas three padding fields that are never zeroed and can leak kernel data\n\nThe fix is simple, just zeroes the padding fields."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/ipv6/ndisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "31910575a9de61e78065e93846e8e7a4894a18bf",
"lessThan": "1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c",
"versionType": "git",
"status": "affected"
},
{
"version": "31910575a9de61e78065e93846e8e7a4894a18bf",
"lessThan": "2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648",
"versionType": "git",
"status": "affected"
},
{
"version": "31910575a9de61e78065e93846e8e7a4894a18bf",
"lessThan": "11d7fe97421cfc81549940c20ed5ac9472d6db05",
"versionType": "git",
"status": "affected"
},
{
"version": "31910575a9de61e78065e93846e8e7a4894a18bf",
"lessThan": "7f56d87e527bb5a13c3e8b0d5840cb6332822f6d",
"versionType": "git",
"status": "affected"
},
{
"version": "31910575a9de61e78065e93846e8e7a4894a18bf",
"lessThan": "4f810c686fde509d1cdaa706322d9d2531f8f1a4",
"versionType": "git",
"status": "affected"
},
{
"version": "31910575a9de61e78065e93846e8e7a4894a18bf",
"lessThan": "b485eef3d97b7aae55ce669b6de555ec81f3d21c",
"versionType": "git",
"status": "affected"
},
{
"version": "31910575a9de61e78065e93846e8e7a4894a18bf",
"lessThan": "ef3645606e4a635d5062a492f22b7f490852ee67",
"versionType": "git",
"status": "affected"
},
{
"version": "31910575a9de61e78065e93846e8e7a4894a18bf",
"lessThan": "ae05340ccaa9d347fe85415609e075545bec589f",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/ipv6/ndisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.24",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.24",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.253",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.203",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.168",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.134",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.81",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.22",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19.12",
"lessThanOrEqual": "6.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.6",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"defaultStatus": "unknown",
"versions": [
{
"version": "V3.1.7",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-06T15:26:53.674468Z",
"id": "CVE-2026-43040",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-909"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.24",
"versionEndExcluding": "5.10.253",
"matchCriteriaId": "23F88A56-E27D-46A7-B32C-65333C046B72"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.203",
"matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.168",
"matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.134",
"matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.81",
"matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.22",
"matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.12",
"matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/11d7fe97421cfc81549940c20ed5ac9472d6db05",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/4f810c686fde509d1cdaa706322d9d2531f8f1a4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7f56d87e527bb5a13c3e8b0d5840cb6332822f6d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ae05340ccaa9d347fe85415609e075545bec589f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b485eef3d97b7aae55ce669b6de555ec81f3d21c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ef3645606e4a635d5062a492f22b7f490852ee67",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}