CVE-2026-53211

netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register

published June 25, 2026

CVSS
—
EPSS
0%
Percentile
1.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register

NFT_META_BRI_IIFHWADDR declares its destination register with

len = ETH_ALEN (6 bytes), which the register-init tracking rounds up to

two 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does

memcpy(dest, br_dev->dev_addr, ETH_ALEN), writing only 6 bytes and

leaving the upper 2 bytes of the second register as uninitialised

nft_do_chain() stack. A downstream load of that register span leaks

those stale bytes to userspace.

Zero the second register before the memcpy so the full declared span is

written.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00121 · 1.8th percentile
Published
2026-06-25T08:39Z
EPSS history
Timeline
  • 25 JUN 08:39Z
    netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
    cvelistv5