Executive brief
A vulnerability was identified in the Linux kernel's Netfilter subsystem, which manages network traffic filtering. A local attacker could potentially exploit this flaw to access sensitive information from the system's memory that should otherwise be protected. This occurs because certain network header checks do not properly clear memory registers, leaving behind data from previous operations.
Technical details
The vulnerability exists in the nft_exthdr_init() function within net/netfilter/nft_exthdr.c. When the NFT_EXTHDR_F_PRESENT flag is set, the function accepts a user-controlled length value (priv->len) and passes it to nft_parse_register_store(), marking those registers as initialized. However, the evaluation path only writes 1 or 4 bytes to the destination register. If a user requests a length greater than 4, the subsequent bytes in the register are never overwritten, allowing uninitialized stack data from nft_regs to be leaked back to userspace. The fix implements a check to ensure the length is exactly 1 byte when the F_PRESENT flag is active.
Affected products
- Linux Linux kernel 4.11 to 6.9.4
Timeline
- 2026-06-09: patched: Initial fix authored by Florian Westphal
- 2026-06-25: advisory: CVE-2026-53218 published by NVD
References
- https://git.kernel.org/stable/c/19748967d59c31d24d21d40b728570788310b237
- https://git.kernel.org/stable/c/46fc15a044e9938e7ea77786fb37edd2cd74f031
- https://git.kernel.org/stable/c/67b27434c43b68a97becda98c9f0c8cf6cba2134
- https://git.kernel.org/stable/c/772cecf198da732faebb5dcfc46d66a505be8495
- https://git.kernel.org/stable/c/78069a6d8bc86c9e036eb82c2af4a19cc1871a53
- https://git.kernel.org/stable/c/8738b1b6d0e639ca1fc0f61516afd3557ac4ecc6
- https://git.kernel.org/stable/c/cd513e43b4b2bd1de39e2367bc4261c699a8652f