In the Linux kernel’s networking stack, a route reply to an RTM_GETROUTE request is constructed without initializing the rtm_tos field of the netlink message header. Because the underlying socket buffer is allocated without zeroing, the uninitialized byte contains leftover kernel memory data. When the kernel copies this header to userspace during recvmsg, that byte is exposed, leaking a fragment of kernel heap data. This uninitialized memory read can disclose confidential information about the kernel or processes running on the system.

All Linux kernel builds that contain the pre‑patch implementation of mpls_getroute() are affected. The vulnerability resides in the MPLS routing subsystem of the kernel’s networking stack. Users running kernels before the commit that zeros rtm_tos will experience the leak.

The CVSS score is 5.5, the EPSS score is <1%, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that exploitation may require a local user or privileged process with the ability to send a crafted RTM_GETROUTE request via a netlink socket. The attack exposes only a single uninitialized byte per request, but repeated requests could disclose additional kernel memory. Overall, the risk is moderate: attackers who can access netlink sockets might gather kernel memory fragments, potentially aiding further discovery of system information.