Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to view sensitive internal memory addresses. This occurs when the system attempts to provide network rule information to a user but fails halfway through, leaving internal pointers in the user's memory buffer. While this does not directly allow for data theft or system crashes, it provides technical details that could help an attacker bypass security protections in more complex attacks.
Technical details
An information leak exists in the x_tables component of the Linux kernel's netfilter subsystem (specifically in IPv4, IPv6, and ARP implementations). The vulnerability occurs in the 'get-entries' path where the kernel copies rule entry headers to userspace before sanitizing counter fields. On SMP kernels, the 'pcnt' field contains a raw per-CPU allocation address. If a userspace buffer faults after the header copy but before the sanitized counter copy, the raw kernel pointer remains in userspace memory. This allows a local attacker to bypass KASLR or gain insights into kernel memory layout. The fix reorders the copy operations to ensure the sensitive pointer is never written to userspace before being overwritten by sanitized data.
Affected products
- Linux Linux 71ae0dff02d7 to b74ba3343eb4 (and other stable branches)
Timeline
- 2026-06-06: other: Patch authored by Kyle Zeng
- 2026-06-25: advisory: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/08a3e218064db11f154ad9ad5541751ea7f34ebe
- https://git.kernel.org/stable/c/0b35dc8527ccc16b7dc34e8a3164313e68cd4e45
- https://git.kernel.org/stable/c/8d67e42ad3b1a95a152541015a07110e06992d6c
- https://git.kernel.org/stable/c/a0d16941adf3a501956d74aefd8d6e217906e79c
- https://git.kernel.org/stable/c/b28e2fcad3db7e8687b15bc20bced26b5b7c920e
- https://git.kernel.org/stable/c/b74ba3343eb44b2cbf7e9665918c287df1d52ebb
- https://git.kernel.org/stable/c/f7f2fbb0e893a0238dc464f8d8c0f5609bec584f