Executive brief
A vulnerability in the Linux kernel's network tap driver could allow a local user to view sensitive information from the system's memory. This occurs because the system fails to clear temporary data before sending it to a user, potentially revealing internal memory addresses. An attacker could use this information to bypass security protections like KASLR, making it easier to launch more complex attacks against the operating system.
Technical details
An information leak exists in the tap_ioctl() function within drivers/net/tap.c. When processing the SIOCGIFHWADDR command, the kernel copies 16 bytes of an on-stack struct sockaddr_storage to userspace. However, netif_get_mac_address() only populates the first 6 to 8 bytes (depending on address length), leaving the remaining bytes uninitialized. These trailing bytes contain sensitive kernel stack contents, including .text and direct-map pointers. A local attacker can exploit this to defeat Kernel Address Space Layout Randomization (KASLR). The issue has been resolved by properly initializing the sockaddr_storage structure at declaration.
Affected products
- Linux Linux Kernel 5.12 through 7.1
Timeline
- 2026-05-20: disclosed: Patch submitted by Weiming Shi
- 2026-06-24: advisory: CVE-2026-52937 published by NVD