CVE-2026-53211

Analyzed Analyzed - Analysis Complete

Linux Kernel Stack Leak in NFT Meta Bridge

Publication date: 2026-06-25

Last updated on: 2026-07-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register NFT_META_BRI_IIFHWADDR declares its destination register with len = ETH_ALEN (6 bytes), which the register-init tracking rounds up to two 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does memcpy(dest, br_dev->dev_addr, ETH_ALEN), writing only 6 bytes and leaving the upper 2 bytes of the second register as uninitialised nft_do_chain() stack. A downstream load of that register span leaks those stale bytes to userspace. Zero the second register before the memcpy so the full declared span is written.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-02

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53211

EUVD

EUVD-2026-39302

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.18 (inc) to 6.18.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's netfilter component, specifically in the nft_meta_bridge module. The issue arises because the IIFHWADDR register declares a destination register length of 6 bytes, but the system rounds this up to 8 bytes internally. When copying the device address, only 6 bytes are written, leaving 2 bytes uninitialized in the stack. These uninitialized bytes can then be leaked to userspace, potentially exposing stale data.

Impact Analysis

The vulnerability can lead to leakage of stale stack data to userspace. This means that sensitive or residual data from kernel memory could be exposed unintentionally, which might be exploited by attackers to gain information that should remain confidential.

Mitigation Strategies

The vulnerability has been resolved by fixing the nft_meta_bridge component in the Linux kernel to properly zero the second register before copying data, preventing stale stack leaks.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-53211. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70