Linux Kernel EUVD-2026-53270

Exploitation requires a local user account that can create network namespaces - on most Linux distributions with kernel.unprivileged_userns_clone=1 (the default), an ordinary unprivileged user meets this bar; on systems with unprivileged user namespace creation disabled, CAP_NET_ADMIN is required. The vulnerable code path is reached specifically through rtm_new_nexthop → nh_res_table_upkeep → nh_res_bucket_migrate, meaning the target system must be performing nexthop resolution table management involving a resilient hash nexthop group (nhg with NH_RES_BUCKET configuration). The critical limiting factor is triggering a failure in nh_notifier_res_bucket_info_init() on the error path - the only example cited is kzalloc returning -ENOMEM, which requires either genuine system memory pressure or another triggerable init failure. The severity of the confidentiality impact is further limited to systems built with CONFIG_INIT_STACK_NONE; all other stack-initialization build modes reduce this to a deterministic kernel panic instead of an exploitable stack memory read.

Real-world priority is low-to-moderate despite the 7.1 CVSS score. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) correctly reflects that remote unauthenticated exploitation is impossible - the attacker must be a local, authenticated user. EPSS at 0.16% (5th percentile) confirms the security community assesses exploitation as unlikely; there is no CISA KEV listing and no POC exists. The dual high-impact ratings (C:H, A:H) inflate the score relative to actual risk: the confidentiality impact requires CONFIG_INIT_STACK_NONE, which most hardened distribution kernels (Ubuntu, RHEL, Debian) do not ship with - those builds would instead produce a hard NULL-pointer dereference kernel panic, making this primarily a DoS on real-world systems. The availability impact (kernel panic) is more universally applicable. SSVC automation dimension is low: reliably triggering a kzalloc failure on a specific code path requires either memory pressure manipulation or specific conditions in notifier initialization, limiting automated wide exploitation. Patch during next maintenance window; no emergency response warranted unless the environment explicitly uses CONFIG_INIT_STACK_NONE.

A local user on an affected Linux system creates a network namespace using unprivileged user namespaces (enabled by default on Ubuntu, Fedora, and most desktop distributions), then sends a sequence of RTM_NEWNEXTHOP netlink messages targeting a resilient nexthop group to trigger the nh_res_table_upkeep code path. By inducing a memory allocation failure in nh_notifier_res_bucket_info_init() - through memory pressure, rlimit manipulation, or other -ENOMEM-triggering conditions - the attacker causes nh_res_bucket_migrate() to execute the vulnerable error path, dereferencing an uninitialized stack pointer in pr_err_ratelimited() and producing a kernel panic (denial of service) or, on CONFIG_INIT_STACK_NONE builds, exposing arbitrary kernel stack contents. No public exploit code is known at time of analysis.