Skip to main content

Linux Kernel EUVDEUVD-2026-53270

| CVE-2026-64576 HIGH
2026-08-05 Linux GHSA-pg7w-xrhc-whgh
Information Disclosure Linux Canonical
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local access required to send netlink messages; PR:L sufficient via unprivileged user namespaces; no integrity impact; C:H and A:H reflect stack leak and kernel panic respectively.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 08, 2026 - 15:30 vuln.today
CVSS changed
Aug 08, 2026 - 15:22 NVD
7.1 (HIGH)
Patch available
Aug 05, 2026 - 09:01 EUVD
CVE Published
Aug 05, 2026 - 08:09 cve.org
HIGH 7.1
CVE Published
Aug 05, 2026 - 08:09 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nexthop: initialize extack in nh_res_bucket_migrate()

nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns -ENOMEM), the error is propagated back before any notifier sets extack._msg, and the error path formats the stale pointer with pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE this dereferences uninitialized stack memory:

Oops: general protection fault, probably for non-canonical address ... KASAN: maybe wild-memory-access in range [...] RIP: 0010:string (lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) _printk (kernel/printk/printk.c:2504) nh_res_bucket_migrate (net/ipv4/nexthop.c:1816) nh_res_table_upkeep (net/ipv4/nexthop.c:1866) rtm_new_nexthop (net/ipv4/nexthop.c:3323) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) netlink_sendmsg (net/netlink/af_netlink.c:1900) Kernel panic - not syncing: Fatal exception

Zero-initialize extack so _msg is NULL on error paths that never set it.

AnalysisAI

Uninitialized stack memory dereference in the Linux kernel's IPv4 nexthop subsystem (net/ipv4/nexthop.c) enables local low-privileged attackers to cause kernel panic or leak sensitive stack contents on systems built with CONFIG_INIT_STACK_NONE. Versions from 5.13 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5 are affected. No public exploit code has been identified and EPSS stands at 0.16% (5th percentile), placing this in the low-urgency tier despite a CVSS 7.1 score driven by dual high-impact outcomes.

Technical ContextAI

The flaw resides in nh_res_bucket_migrate() at net/ipv4/nexthop.c:1816, part of the kernel's resilient nexthop group upkeep path. The function allocates a netlink_ext_ack structure on the stack - the kernel's standard mechanism for carrying structured error annotations back to netlink userspace callers - and passes it uninitialized to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails before any notifier writes extack._msg (e.g., kzalloc returning -ENOMEM), the error path immediately calls pr_err_ratelimited("%s\n", extack._msg), treating the raw stack garbage as a valid C string pointer. Under CONFIG_INIT_STACK_NONE the CPU attempts to dereference a potentially non-canonical address, triggering a general protection fault and kernel panic as shown in the provided KASAN trace. The root cause is functionally equivalent to CWE-457 (Use of Uninitialized Variable). The fix is a single zero-initialization of the extack struct so _msg is guaranteed NULL on all error paths that never populate it. The introducing commit is 7c37c7e00411b3d1e0c5292368317aca69d1f324; affected CPE is cpe:2.3:a:linux:linux across all architectures.

RemediationAI

Upgrade to a patched kernel version: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 (or any later release), sourcing distribution packages from Canonical (Ubuntu) or other vendors who are backporting the stable commits. If immediate patching is not feasible, two compensating controls should be considered in sequence. First, disable unprivileged user namespace creation via sysctl kernel.unprivileged_userns_clone=0 (supported on Ubuntu/Debian derivatives) - this prevents low-privileged users from creating network namespaces to send rtnetlink messages, raising the effective privilege bar to CAP_NET_ADMIN; however, this breaks rootless container runtimes (Podman, Docker rootless) and some Chromium sandbox configurations. Second, ensure the production kernel is built with CONFIG_INIT_STACK_ALL or CONFIG_INIT_STACK_ALL_ZERO rather than CONFIG_INIT_STACK_NONE - this does not prevent the bug but converts the wild-pointer dereference into a deterministic NULL-pointer dereference crash, eliminating the confidentiality impact and making the DoS impact more predictable; note this is a compile-time change requiring a kernel rebuild.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

EUVD-2026-53270 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy