CVE-2026-53211

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register NFT_META_BRI_IIFHWADDR declares its destination register with len = ETH_ALEN (6 bytes), which the register-init tracking rounds up to two 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does memcpy(dest, br_dev->dev_addr, ETH_ALEN), writing only 6 bytes and leaving the upper 2 bytes of the second register as uninitialised nft_do_chain() stack. A downstream load of that register span leaks those stale bytes to userspace. Zero the second register before the memcpy so the full declared span is written.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/07acb9798477535933bd658ac9fa85b6cb10d995	Patch
https://git.kernel.org/stable/c/c7d573551f9286100a055ef696cde6af54549677	Patch
https://git.kernel.org/stable/c/f1e81d571e375d10e50e852223593493d98c1bac	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc7::::::

History

No history.

Information

Published : 2026-06-25 09:16

Updated : 2026-07-02 20:53

NVD link : CVE-2026-53211

Mitre link : CVE-2026-53211

CVE.ORG link : CVE-2026-53211

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2026-53211", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cbd2257dc96e3e46217540fcb095a757ffa20d96", "lessThan": "07acb9798477535933bd658ac9fa85b6cb10d995", "versionType": "git"}, {"status": "affected", "version": "cbd2257dc96e3e46217540fcb095a757ffa20d96", "lessThan": "f1e81d571e375d10e50e852223593493d98c1bac", "versionType": "git"}, {"status": "affected", "version": "cbd2257dc96e3e46217540fcb095a757ffa20d96", "lessThan": "c7d573551f9286100a055ef696cde6af54549677", "versionType": "git"}], "programFiles": ["net/bridge/netfilter/nft_meta_bridge.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.36", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.13", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bridge/netfilter/nft_meta_bridge.c"], "defaultStatus": "affected"}]}], "published": "2026-06-25T09:16:38.697", "references": [{"url": "https://git.kernel.org/stable/c/07acb9798477535933bd658ac9fa85b6cb10d995", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c7d573551f9286100a055ef696cde6af54549677", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f1e81d571e375d10e50e852223593493d98c1bac", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n\nNFT_META_BRI_IIFHWADDR declares its destination register with\nlen = ETH_ALEN (6 bytes), which the register-init tracking rounds up to\ntwo 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does\nmemcpy(dest, br_dev->dev_addr, ETH_ALEN), writing only 6 bytes and\nleaving the upper 2 bytes of the second register as uninitialised\nnft_do_chain() stack. A downstream load of that register span leaks\nthose stale bytes to userspace.\n\nZero the second register before the memcpy so the full declared span is\nwritten."}], "lastModified": "2026-07-02T20:53:52.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7AAD18F-28C9-4D16-B57E-FAB774F81A3B", "versionEndExcluding": "6.18.36", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E", "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1039E95A-8CC3-4C88-8FF9-5C08EEB861C9"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}