RUSTSEC-2025-0142: Segmentation fault and invalid memory read in `mnl::cb_run`

What to do

1. See which version you have: cargo tree -i mnl (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p mnl. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example mnl = "0.3.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The function mnl::cb_run is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.

Passing a crafted byte slice to mnl::cb_run can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.

This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.

The underlying issue is a bug in libmnl where during validation nlh->nlmsg_len is cast to an int and becomes negative if nlmsg_len is greater than INT_MAX. This causes the validation to succeed even if the buffer is too small for the message. This has been fixed in libmnl but still affects version 1.0.5.

The issue in mnl was fixed in commit cd51bdc by checking the validity of netlink messages passed to mnl::cb_run.

References

• Package: crates.io/crates/mnl
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0142.html
• Report: github.com/mullvad/mnl-rs/issues/15

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.