CVE-2026-53134

Analyzed Analyzed - Analysis Complete

Stack Leak in Linux Kernel via NFT_FIB_RESULT_OIFNAME

Publication date: 2026-06-25

Last updated on: 2026-07-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: fix stale stack leak via the OIFNAME register For NFT_FIB_RESULT_OIFNAME the destination register is declared with len = IFNAMSIZ (four 32-bit registers), but on the lookup-fail, RTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one register via "*dest = 0". The remaining three registers are left as whatever was on the stack in nft_do_chain()'s struct nft_regs, and a downstream expression that loads the register span can leak that uninitialised kernel stack to userspace. The NFTA_FIB_F_PRESENT existence check has the same shape: it is only meaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type while the eval stores a single byte via nft_reg_store8(), leaving the rest of the declared span stale. Fix both: - replace the bare "*dest = 0" in the eval with nft_fib_store_result(), which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already used on the other early-return path), and - restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its destination as a single u8, so the marked span matches the one byte the eval writes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-07

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53134

EUVD

EUVD-2026-39339

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 4.10 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's netfilter nft_fib component. Specifically, when handling the NFT_FIB_RESULT_OIFNAME register, the code declares a destination register length of IFNAMSIZ (four 32-bit registers), but in certain failure paths, it only writes one register and leaves the remaining three registers uninitialized on the kernel stack.

Because these leftover registers contain stale data from the kernel stack, a downstream expression that loads this register span can leak uninitialized kernel stack memory to userspace, potentially exposing sensitive information.

The fix involved replacing the partial write with a function that properly initializes the entire register span and restricting certain checks to only valid result types to prevent stale data exposure.

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the nft_fib code to properly initialize the stack memory and restrict certain checks to appropriate result types.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Impact Analysis

This vulnerability can lead to leakage of uninitialized kernel stack memory to userspace. Such leakage may expose sensitive kernel memory contents, which could include confidential information or data that could aid an attacker in further exploiting the system.

Hi! I’m here to help you understand CVE-2026-53134. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70