CVE-2026-52985

netdevsim: zero initialize struct iphdr in dummy sk_buff

MEDIUM

5.5

CVSS Score

Published: June 24, 2026 at 04:28 PM UTC

Updated: July 14, 2026 at 05:04 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: netdevsim: zero initialize struct iphdr in dummy sk_buff Syzbot reports a KMSAN uninit-value originating from nsim_dev_trap_skb_build, with the allocation also being performed in the same function. Fix this by calling skb_put_zero instead of skb_put to guarantee zero initialization of the whole IP header.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.11 ≤ v < 5.15.2095.16 ≤ v < 6.1.1755.4 ≤ v < 5.10.2585.4 ≤ v < 5.15.2095.4 ≤ v < 6.1.1755.4 ≤ v < 6.12.915.4 ≤ v < 6.18.335.4 ≤ v < 6.6.1415.4 ≤ v < 7.0.105.4 ≤ v < 7.16.13 ≤ v < 6.18.336.19 ≤ v < 7.0.106.2 ≤ v < 6.6.1416.7 ≤ v < 6.12.917.1 rc1da58f90f11f597520f226caff1d3cfc115abedc9

Vendor states this is fixed in 175556c049eaec14efde8c6475e763b7579b9de7 (fixed)

Vendor states this is fixed in 1b7b6ae0e93b8d512e208b1378d74af052e4f4e7 (fixed)

Vendor states this is fixed in 35eaa6d8d6c2ee65e96f507add856e0eacf24591 (fixed)

Vendor states this is fixed in 6e2cfd0904976e701d7a76b86b694e72af230ab0 (fixed)

Vendor states this is fixed in 750d0091bebf44975421268d37484ef87060d263 (fixed)

Vendor states this is fixed in 818f7673ed7f4a29d4b9cee8184c47d6e57162b4 (fixed)

Vendor states this is fixed in 978ca6ff789f1f19c03288ac20cc1f4774e88490 (fixed)

Vendor states this is fixed in bc6002865e8c4fcf9e94975f7cf023448d8764e2 (fixed)

Vendor states this is fixed in 5.10.258 (unaffected)

Vendor states this is fixed in 5.15.209 (unaffected)

Vendor states this is fixed in 5.4 (unaffected)

Vendor states this is fixed in 6.1.175 (unaffected)