Linux Kernel CVE-2026-53219

The Linux kernel's netfilter framework uses x_tables to manage IPv4, IPv6, and ARP firewall rules (iptables, ip6tables, arptables). Rule entries carry per-CPU counters (pcnt) for efficient packet and byte accounting on SMP systems, where pcnt holds the virtual address of the percpu memory allocation. When userspace invokes the get-entries operation, the kernel serializes the rule entry header - including the raw pcnt field - into the caller's buffer before overwriting the counter fields with a sanitized snapshot. The race window exists because the copy is not atomic: if the userspace buffer is arranged (e.g., via mprotect) so that the page covering the counter offset faults after pcnt lands in user memory but before the sanitized overwrite, the syscall aborts with -EFAULT and the raw kernel virtual address remains readable. The fix reorders the copy: only the pre-counter header prefix is written first, then the sanitized counter is placed directly, ensuring the raw percpu pointer never transiently exists in userspace. Affected CPE is cpe:2.3:o:linux:linux_kernel:*. NVD does not assign a CWE, but the vulnerability is characteristic of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).