Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to view sensitive information from the system's memory. The issue occurs in the Netfilter component, which handles network traffic filtering and routing. An attacker could exploit this to leak internal kernel data, potentially aiding in further attacks or exposing private system information.
Technical details
A kernel stack information leak exists in net/netfilter/nft_fib.c and its IPv4/IPv6 variants. For NFT_FIB_RESULT_OIFNAME, the destination register is allocated 16 bytes (IFNAMSIZ), but on certain error or mismatch paths (lookup-fail, RTN_LOCAL), the evaluator only zero-initializes the first 4 bytes. The remaining 12 bytes of the register span retain uninitialized data from the kernel stack (struct nft_regs). A local attacker can use a downstream nftables expression to load this register span and leak the stale stack data to userspace. The fix ensures the entire destination buffer is padded using strscpy_pad() via nft_fib_store_result().
Affected products
- Linux Linux Kernel f6d0cbcf09c5 to 6.13.y
Timeline
- 2026-06-15: patched: Initial patch authored by Davide Ornaghi
- 2026-06-25: disclosed: CVE-2026-53134 published
References
- https://git.kernel.org/stable/c/3544210609f6d1db282bbdeca639104ef624c393
- https://git.kernel.org/stable/c/6744e49fe51bfba26522acc2d0e9703cb41d8e50
- https://git.kernel.org/stable/c/84d8f58cf28a0415413f43ba7148f7bacd4c1b6e
- https://git.kernel.org/stable/c/8c84885e9790823828bb8084736ea15769b1ac16
- https://git.kernel.org/stable/c/ab185e0c4fb82dfba6fb86f8271e06f931d9c64c
- https://git.kernel.org/stable/c/d19ddef8c327a4773ff81f8e51027d1e0b4cf069
- https://git.kernel.org/stable/c/eb8a8124484dbc3c2b543e207da39bbccb703d31