CVE-2026-53218
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag nft_exthdr_init() passes user-controlled priv->len to nft_parse_register_store(), which marks that many bytes in the register bitmap as initialized. However, when NFT_EXTHDR_F_PRESENT is set, the eval paths write only 1 byte (nft_reg_store8) or 4 bytes (*dest = 0 on TCP/DCCP error path). When len > 4, registers beyond the first are never written, retaining uninitialized stack data from nft_regs. Bail out if userspace requests too much data when F_PRESENT is set.
How to fix
- linux linux_kernel5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 or later
- git.kernel.org/stable/c/19748967d59c31d24d21d40b728570788310b237
- git.kernel.org/stable/c/46fc15a044e9938e7ea77786fb37edd2cd74f031
- git.kernel.org/stable/c/67b27434c43b68a97becda98c9f0c8cf6cba2134
- git.kernel.org/stable/c/772cecf198da732faebb5dcfc46d66a505be8495
- git.kernel.org/stable/c/78069a6d8bc86c9e036eb82c2af4a19cc1871a53
- git.kernel.org/stable/c/8738b1b6d0e639ca1fc0f61516afd3557ac4ecc6
- git.kernel.org/stable/c/cd513e43b4b2bd1de39e2367bc4261c699a8652f
- git.kernel.org/stable/c/f08fb3d42fd3aad0b7a263da3ac3ebaf0845e265
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.11 ≤ v < 5.10.259, 5.11 ≤ v < 5.15.210, 5.16 ≤ v < 6.1.176, 6.2 ≤ v < 6.6.143, 6.7 ≤ v < 6.12.94, 6.13 ≤ v < 6.18.36, 6.19 ≤ v < 7.0.13, 7.1 | 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.