CVE-2026-52937

In the Linux kernel, the following vulnerability has been resolved:

tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an

uninitialised on-stack struct sockaddr_storage to userspace via

ifr_hwaddr, but netif_get_mac_address() only writes sa_family and

dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.

Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a

macvtap chardev returns kernel .text and direct-map pointers, defeating

KASLR.

Initialise ss at declaration.