CVE-2026-74659

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: bridge: mrp: fix uninitialised bytes on the wire<br /> <br /> br_mrp_alloc_test_skb() builds MRP test frames on an skb from<br /> dev_alloc_skb(), which does not clear the linear data area. On the MRA<br /> ring-role branch the sub-option TLV header is appended with<br /> <br /> sub_tlv = skb_put(skb, sizeof(*sub_tlv));<br /> sub_tlv-&gt;type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;<br /> <br /> so sub_tlv-&gt;length is never written, and the two trailing alignment bytes<br /> are appended with a bare skb_put() that does not clear them either. The<br /> neighbouring oui and sub_opt regions are explicitly zeroed, so three<br /> uninitialised bytes are left in every MRA MRP_Test frame that goes out.<br /> <br /> Put the sub-option TLV header and the alignment padding in a single<br /> skb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no<br /> payload, so the zeroed length field is already the value it should have.