Stack Info Leak in Linux Kernel tap_ioctl

Publication date: 2026-06-24

Last updated on: 2026-07-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an uninitialised on-stack struct sockaddr_storage to userspace via ifr_hwaddr, but netif_get_mac_address() only writes sa_family and dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised. Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a macvtap chardev returns kernel .text and direct-map pointers, defeating KASLR. Initialise ss at declaration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-08

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52937

EUVD

EUVD-2026-38707

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.10.21 (inc) to 5.11 (exc)
linux	linux_kernel	From 5.4.103 (inc) to 5.5 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 5.11.4 (inc) to 6.18.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's tap_ioctl() function, specifically in the SIOCGIFHWADDR path. The function copies 16 bytes of an uninitialized on-stack struct sockaddr_storage to userspace via ifr_hwaddr. However, the netif_get_mac_address() function only initializes part of this structure, leaving 8 bytes uninitialized. These uninitialized bytes leak kernel stack contents, including kernel .text and direct-map pointers, which can defeat Kernel Address Space Layout Randomization (KASLR).

Impact Analysis

The vulnerability can lead to leakage of sensitive kernel memory information to userspace. This information disclosure can allow attackers to bypass KASLR, a security feature designed to randomize the location of kernel code in memory, making it harder to exploit other vulnerabilities. By defeating KASLR, attackers may increase their chances of successfully executing further attacks on the system.

Hi! I’m here to help you understand CVE-2026-52937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70