CVE-2026-74577

A flaw was found in the Linux kernel's Multiprotocol Label Switching (MPLS) networking component. When processing an RTM_GETROUTE request, the mpls_getroute() function fails to initialize a specific byte in the response message. This oversight allows a local user to obtain a single byte of uninitialized heap memory. This information disclosure could potentially reveal sensitive data.

This vulnerability is rated as having Low severity for Red Hat Enterprise Linux because exploitation is confined to local authenticated users, requires MPLS routing to be enabled, and discloses only a single byte of uninitialized kernel memory. Standard Red Hat Enterprise Linux installations do not configure or utilize MPLS routing by default, restricting exposure to specialized network deployments. Furthermore, the limited information disclosure does not allow privilege escalation or compromise host availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.