CVE-2026-64576

Status: UPDATED  |  Advisory ID: CVE-2026-64576

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

nexthop: initialize extack in nh_res_bucket_migrate()

nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to

call_nexthop_res_bucket_notifiers(). When

nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns

-ENOMEM), the error is propagated back before any notifier sets

extack._msg, and the error path formats the stale pointer with

pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE

this dereferences uninitialized stack memory:

Oops: general protection fault, probably for non-canonical address ...

KASAN: maybe wild-memory-access in range [...]

RIP: 0010:string (lib/vsprintf.c:730)

vsnprintf (lib/vsprintf.c:2945)

_printk (kernel/printk/printk.c:2504)

nh_res_bucket_migrate (net/ipv4/nexthop.c:1816)

nh_res_table_upkeep (net/ipv4/nexthop.c:1866)

rtm_new_nexthop (net/ipv4/nexthop.c:3323)

rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)

netlink_sendmsg (net/netlink/af_netlink.c:1900)

Kernel panic - not syncing: Fatal exception

Zero-initialize extack so _msg is NULL on error paths that never set it. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References