CVE-2026-53134: Linux Kernel Netfilter Memory Leak in FIB Lookups

Technical summary

CVE-2026-53134 affects the nft_fib{4,6}_eval() functions in the Linux kernel's netfilter packet filtering system. The vulnerability occurs in two distinct code paths: 1. **OIFNAME Register Leak**: When NFT_FIB_RESULT_OIFNAME result type is used, the destination register is declared to span IFNAMSIZ (four 32-bit values). However, on lookup failure, RTN_LOCAL, or output interface mismatch conditions, the code only zeros one register via "*dest = 0", leaving three registers containing whatever data was previously on the kernel stack. A downstream expression reading the full register span can leak this uninitialized memory. 2. **NFTA_FIB_F_PRESENT Flag Scope**: The NFTA_FIB_F_PRESENT flag is only semantically valid for NFT_FIB_RESULT_OIF, but the kernel accepts it for any result type. When set, it stores a single byte via nft_reg_store8(), leaving the remainder of the register span uninitialized. The fix replaces bare register zeroing with nft_fib_store_result(), which properly pads the entire IFNAMSIZ span using strscpy_pad(), and restricts the PRESENT flag to its intended result type with a properly sized single-byte destination register.

Business impact

This vulnerability enables local privilege escalation reconnaissance and potential information disclosure attacks. An authenticated local attacker can extract kernel address space layout information, cryptographic key material, or other sensitive data resident in kernel memory at exploitation time. In environments where local user accounts are provisioned (development systems, shared servers, containers with user namespaces), this represents a meaningful confidentiality risk. Kernel ASLR and other mitigations become less effective when attackers can reliably leak kernel pointers.

Affected systems

The Linux kernel is affected across multiple stable and development branches. While the specific affected version ranges are determined by the vendor's advisory, this issue exists in netfilter code that has been present for several kernel releases. Systems running kernels with netfilter FIB module support (nf_tables with fib lookup) are potentially vulnerable. Verify the exact affected versions and your kernel configuration against the official Linux kernel security advisory.

Exploitability

Exploitation requires local system access and the ability to create or modify netfilter rules (typically requiring CAP_NET_ADMIN capability or equivalent). This is not a remote exploit vector. The vulnerability is triggered through crafted nftables rule sets that exercise the affected code paths. No known public exploit code exists at this time, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog. However, the attack surface is present on any system with unprivileged users who can create netfilter rules.

Remediation

Patch the Linux kernel to a version incorporating the fix for CVE-2026-53134. The remedy involves applying commits that replace bare register initialization with proper nft_fib_store_result() calls and scope restrictions on the NFTA_FIB_F_PRESENT flag. Verify the specific patched kernel versions against your vendor's advisory (e.g., linux.org, your distribution's security page). Interim mitigation: restrict netfilter rule creation and nftables access to trusted administrators only.

Patch guidance

Monitor your Linux vendor's security bulletins for kernel updates incorporating the nft_fib fix. For distributions using stable kernel branches (Red Hat Enterprise Linux, Ubuntu LTS, Debian stable), patches will be released through standard update channels. Apply kernel updates promptly; this typically requires a system reboot. If you maintain custom kernel builds, cherry-pick the upstream commit fixing nft_fib{4,6}_eval() initialization. Verify successful patching by confirming the kernel version matches or exceeds the vendor's advisory version and reviewing the kernel source for the presence of nft_fib_store_result() calls in the affected code paths.

Detection guidance

Monitor system logs and netfilter audit events for unusual nftables rule creation by non-administrative users. Look for rules explicitly using fib result type with OIFNAME or PRESENT flags, which would be rare in legitimate configurations. Kernel sanitization tools (KASAN, KMSAN) will flag uninitialized memory reads in the affected code paths if enabled in production or testing. Inspect /proc/net/nf_tables_set and audit logs to identify suspicious rule patterns. Note that absence of alerts does not indicate absence of exploitation; passive inspection of active rules is necessary.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS 5.5 MEDIUM score reflects the requirement for local access and the information-disclosure nature rather than code execution. However, it sits at the higher end of the medium range due to the kernel's privileged position. Prioritize systems where local user accounts exist or where container escape scenarios are plausible. Development and testing environments should be patched first to prevent reconnaissance of production systems. Non-patching duration should be measured in weeks, not months.

Risk score, explained

CVSS 3.1 assigns a score of 5.5 (MEDIUM), derived from: Attack Vector Local (no network), Attack Complexity Low (no special conditions), Privileges Required (Low—local account needed), User Interaction None, Scope Unchanged, Confidentiality Impact None formally, Integrity and Availability impact None. The score reflects the localized attack surface and information-disclosure nature. However, the practical impact is heightened in multi-tenant or container environments where local isolation is weaker. Organizations with strong local access controls may assign lower risk; those with many local users should consider internal risk adjustment upward.

Frequently asked questions