Linux Kernel CVE-2026-52937

Exploitation requires a local attacker with low-privilege access to a macvtap or tap character device (e.g., /dev/tapX). This typically means: (1) execution on a Linux host or guest VM where macvtap is used for virtual machine networking (common in KVM/QEMU hypervisor deployments), or (2) a local user or container process that has been granted access to the tap device node. The ioctl target is SIOCGIFHWADDR on the tap/macvtap file descriptor. No special kernel configuration beyond the presence of the tap driver (CONFIG_TUN, typically built-in on most distributions) is required. What limits exploitation: the attacker cannot be purely remote - direct local code execution or VM-guest access is required (AV:L per CVSS); the process must be able to open the macvtap chardev, which is typically gated by device-node permissions; this vulnerability alone causes information disclosure only - a second, separate vulnerability is required to convert the KASLR bypass into code execution.

The real-world risk of this vulnerability is moderate-to-significant despite the misleading CVSS vector provided with the advisory. CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H assigns zero confidentiality impact and high availability impact - this is inconsistent with the description, which describes an information disclosure of kernel pointers with no availability consequence. The corrected assessment (see assessed_cvss_vector) reflects C:H/A:N. EPSS at 0.15% (5th percentile) and absence from CISA KEV indicate no observed widespread exploitation. However, KASLR bypass primitives are standard components of local privilege-escalation exploit chains targeting the Linux kernel; the realistic threat is not standalone exploitation of this issue but its use as a stepping stone to a full LPE when combined with a separate kernel memory-corruption bug. Exploitation requires local low-privilege access to a macvtap device - a constraint that limits attacker pool to local users or code running inside VMs on hypervisors using macvtap for networking. The constraint is meaningful but not unusual in cloud and containerized environments. Patch availability across stable branches reduces urgency for patched systems.

A local user or malicious process running inside a virtual machine whose NIC is backed by a host macvtap device opens /dev/tapX and issues ioctl(fd, SIOCGIFHWADDR, &ifr). The returned ifr_hwaddr contains the expected MAC address in the first 8 bytes, but bytes 8-15 hold uninitialized kernel stack data from a previous stack frame - including kernel .text addresses and physmap pointers. The attacker parses these pointers to compute the kernel base address, defeating KASLR and enabling reliable targeting of a separate kernel memory-corruption exploit for full privilege escalation. No public exploit code has been identified at time of analysis.