Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to view small amounts of sensitive information from the system's memory. This occurs because the netfilter component, which handles network traffic filtering, fails to properly clear internal storage before sending data to user-level applications. While the leaked data is limited to a few bytes at a time, it could potentially expose fragments of system activity or security-related information.
Technical details
An information leak exists in the nft_meta_bridge component of the Linux kernel netfilter subsystem. The NFT_META_BRI_IIFHWADDR register declares a 6-byte length (ETH_ALEN), but the register-init tracking mechanism rounds this up to 8 bytes (two 32-bit registers). The nft_meta_bridge_get_eval() function performs a 6-byte memcpy into this 8-byte span without zeroing the remaining 2 bytes, leaving them populated with stale data from the nft_do_chain() stack. A local attacker can perform a downstream load of this register span to leak these uninitialized stack bytes to userspace. The issue has been resolved by explicitly zeroing the destination register before the memcpy operation.
Affected products
- Linux Linux 6.18, 7.0
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory