High severity · published May 1, 2026
CVE-2026-43040
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
7.1
CVSS
0.1%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
When processing Router Advertisements with user options the kernel
builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct
has three padding fields that are never zeroed and can leak kernel data
The fix is simple, just zeroes the padding fields.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
2.6.24 before 5.10.253; 5.11 before 5.15.203; 5.16 before 6.1.168; 6.2 before 6.6.134; 6.7 before 6.12.81; 6.13 before 6.18.22; +7 more · source: NVD
LI
Linux · Linux
31910575a9de61e78065e93846e8e7a4894a18bf before 1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c; 31910575a9de61e78065e93846e8e7a4894a18bf before 2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648; 31910575a9de61e78065e93846e8e7a4894a18bf before 11d7fe97421cfc81549940c20ed5ac9472d6db05; 31910575a9de61e78065e93846e8e7a4894a18bf before 7f56d87e527bb5a13c3e8b0d5840cb6332822f6d; 31910575a9de61e78065e93846e8e7a4894a18bf before 4f810c686fde509d1cdaa706322d9d2531f8f1a4; 31910575a9de61e78065e93846e8e7a4894a18bf before b485eef3d97b7aae55ce669b6de555ec81f3d21c; +3 more · source: vendor
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.6; V3.1.5; V3.1.7; V3.1.6; V3.1.5; V3.1.7 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.6; V3.1.5; V3.1.7; V3.1.6; V3.1.5; V3.1.7 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.6; V3.1.5; V3.1.7 · source: CISA
In the news
VulnerabilityMedium
ZDI-26-682: Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2026-43040.
Sep 14, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-43040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-43040
Patch
https://git.kernel.org/stable/c/11d7fe97421cfc81549940c20ed5ac9472d6db05
Patch
https://git.kernel.org/stable/c/1da9023f6b071a38e5430ffbce4b70b2b1ac4f9c
Patch
https://git.kernel.org/stable/c/2fe4d0ba690a69ad6ae9f7ab9bdc96e02610b648
Patch
https://git.kernel.org/stable/c/4f810c686fde509d1cdaa706322d9d2531f8f1a4
Patch
https://git.kernel.org/stable/c/7f56d87e527bb5a13c3e8b0d5840cb6332822f6d
Patch
https://git.kernel.org/stable/c/ae05340ccaa9d347fe85415609e075545bec589f
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability