PT-2026-52306 · Linux · Linux

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-53211

Mitre

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft meta bridge: fix stale stack leak via IIFHWADDR register

NFT META BRI IIFHWADDR declares its destination register with len = ETH ALEN (6 bytes), which the register-init tracking rounds up to two 32-bit registers (8 bytes). nft meta bridge get eval() then does memcpy(dest, br dev->dev addr, ETH ALEN), writing only 6 bytes and leaving the upper 2 bytes of the second register as uninitialised nft do chain() stack. A downstream load of that register span leaks those stale bytes to userspace.

Zero the second register before the memcpy so the full declared span is written.

Identificadores relacionados

CVE-2026-53211

Produtos afetados

Linux

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-53211 · Nota de Segurança
• https://git.kernel.org/stable/c/c7d573551f9286100a055ef696cde6af54549677 · Nota
• https://git.kernel.org/stable/c/f1e81d571e375d10e50e852223593493d98c1bac · Nota
• https://git.kernel.org/stable/c/07acb9798477535933bd658ac9fa85b6cb10d995 · Nota