Executive brief
A memory leakage vulnerability exists in the Linux kernel's netfilter bridge metadata handling. The nft_meta_bridge module fails to properly validate return values when retrieving VLAN information, potentially exposing kernel stack memory to unprivileged users. This could allow sensitive kernel data to be read through network filtering rules.
Technical details
This vulnerability is an information disclosure flaw in the netfilter nft_meta_bridge module's NFT_META_BRI_IIFPVID handler. The vulnerable code fails to check the return value of br_vlan_get_pvid_rcu() before using the uninitialized output parameter p_pvid, leading to kernel stack data being exposed. An attacker with network access or local access to craft netfilter rules could trigger this code path and read sensitive kernel memory. The fix involves adding a conditional check to validate the return value and jump to error handling if the function fails, preventing use of uninitialized stack memory.
Affected products
- Linux Linux kernel all versions with nft_meta_bridge NFT_META_BRI_IIFPVID support
Timeline
- 2026-08-15: disclosed
- 2026-06-21: patched: Fix committed upstream
- 2026-07-24: patched: Fix backported to stable kernels