CVE-2026-74659

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mrp: fix uninitialised bytes on the wire

brmrpalloctestskb() builds MRP test frames on an skb from devallocskb(), which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is appended with

sub_tlv = skb_put(skb, sizeof(*sub_tlv));
sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR;

so subtlv->length is never written, and the two trailing alignment bytes are appended with a bare skbput() that does not clear them either. The neighbouring oui and subopt regions are explicitly zeroed, so three uninitialised bytes are left in every MRA MRPTest frame that goes out.

Put the sub-option TLV header and the alignment padding in a single skbputzero(), which clears both. The AUTO_MGR sub-TLV carries no payload, so the zeroed length field is already the value it should have.