CVE-2026-53211: Linux Kernel Netfilter Memory Leak via IIFHWADDR Register

Technical summary

The vulnerability exists in the nft_meta_bridge module's handling of the NFT_META_BRI_IIFHWADDR register. The register declaration specifies ETH_ALEN (6 bytes) as the destination size, but the register-tracking subsystem allocates two 32-bit register slots (8 bytes total) to accommodate the declared length. The nft_meta_bridge_get_eval() function performs a memcpy of only 6 bytes (the MAC address) into this 8-byte span, leaving the upper 2 bytes uninitialized. Because this memory resides on the nft_do_chain() stack, any subsequent load operation on the full register width exposes those stale bytes to userspace. The remediation clears the second register before the memcpy to ensure the entire declared span is properly initialized.

Business impact

This vulnerability permits unprivileged local users to leak kernel memory contents through netfilter rule evaluation. While the exploit requires local access and netfilter rule configuration privileges, the leaked data could contain sensitive kernel state, cryptographic material, or pointers useful for further exploitation. Organizations relying on netfilter for local container isolation, micro-segmentation, or MAC-based filtering in multi-tenant environments should prioritize remediation to prevent information disclosure attacks.

Affected systems

The Linux kernel is affected. The vulnerability manifests in the netfilter subsystem specifically within the nft_meta_bridge module, which handles bridge-specific metadata queries in nftables firewall rules. Any Linux system running a kernel version with this unpatched netfilter code and using nftables rules that access the IIFHWADDR register is vulnerable. This includes modern distributions with nftables support where local users can load or modify firewall rules.

Exploitability

Exploitation requires local access and the ability to load or modify nftables rules—typically requiring root or netadm group membership depending on policy. The vulnerability is not remotely exploitable and does not provide direct code execution. However, the memory disclosure itself is straightforward once rule access is available: a malicious rule querying IIFHWADDR followed by a register load to userspace will leak uninitialized bytes. The barrier to exploitation is moderate; it is not a zero-click attack but is readily weaponizable by any user with rule-loading privileges.

Remediation

The fix involves initializing the full register span (both 32-bit slots) to zero before the memcpy operation, ensuring no stale stack data remains in the upper 2 bytes. Verify availability of patched kernel versions from your Linux distribution and test in a non-production environment before deployment. Organizations should monitor their distribution's security advisories for patched kernel releases that address this netfilter issue.

Patch guidance

Apply kernel updates from your Linux distribution that include the netfilter nft_meta_bridge fix. Verify against your vendor's advisory to confirm the specific patched kernel version. After patching, reboot systems to activate the corrected kernel. In environments where immediate kernel updates are infeasible, consider temporarily restricting nftables rule loading and modification to only trusted administrators and auditing rule configuration changes.

Detection guidance

Detection at runtime is difficult without kernel instrumentation, as the vulnerability is a memory-disclosure issue rather than a crash or obvious behavioral anomaly. Focus on preventive measures: audit nftables rule sets to identify rules using the IIFHWADDR register and assess who has permission to load or modify rules. Monitor kernel logs for unexpected nftables rule errors or warnings. On patched systems, verify the netfilter module version and conduct periodic audits of active firewall rules to ensure they reflect organizational policy.

Why prioritize this

Although this is a local-only vulnerability requiring rule-loading privileges, memory disclosure vulnerabilities in kernel subsystems warrant prompt remediation because leaked kernel pointers and state can enable subsequent privilege escalation or other attacks. The MEDIUM CVSS score and availability of a straightforward fix make this suitable for near-term patching cycles. Prioritize systems where untrusted users have local access or where netfilter rules are dynamically managed by less-trusted services.

Risk score, explained

CVSS 3.1 MEDIUM (5.5) reflects the local-only attack vector, low complexity, and requirement for local user privileges. The impact is confidentiality loss (stale kernel memory disclosure) with no direct integrity or availability loss from the vulnerability itself. The score appropriately captures that while the attack surface is limited, the leakage of kernel memory can facilitate further exploitation.

Frequently asked questions