nexthop: initialize extack in nh_res_bucket_migrate()
Summary
| CVE | CVE-2026-64576 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-08-05 08:16:37 UTC |
|---|
| Updated | 2026-08-05 08:16:37 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
nexthop: initialize extack in nh_res_bucket_migrate()
nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to
call_nexthop_res_bucket_notifiers(). When
nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns
-ENOMEM), the error is propagated back before any notifier sets
extack._msg, and the error path formats the stale pointer with
pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE
this dereferences uninitialized stack memory:
Oops: general protection fault, probably for non-canonical address ...
KASAN: maybe wild-memory-access in range [...]
RIP: 0010:string (lib/vsprintf.c:730)
vsnprintf (lib/vsprintf.c:2945)
_printk (kernel/printk/printk.c:2504)
nh_res_bucket_migrate (net/ipv4/nexthop.c:1816)
nh_res_table_upkeep (net/ipv4/nexthop.c:1866)
rtm_new_nexthop (net/ipv4/nexthop.c:3323)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
netlink_sendmsg (net/netlink/af_netlink.c:1900)
Kernel panic - not syncing: Fatal exception
Zero-initialize extack so _msg is NULL on error paths that never set it. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 7c37c7e00411b3d1e0c5292368317aca69d1f324 c0936c131a71657afc635d0db2ab096d15d473e1 git |
Not specified |
| CNA |
Linux |
Linux |
affected 7c37c7e00411b3d1e0c5292368317aca69d1f324 3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d git |
Not specified |
| CNA |
Linux |
Linux |
affected 7c37c7e00411b3d1e0c5292368317aca69d1f324 d536bf205c71f700f6de2086038c3e1d77724715 git |
Not specified |
| CNA |
Linux |
Linux |
affected 7c37c7e00411b3d1e0c5292368317aca69d1f324 18506d7263768d76ac8e057ba55a4d9da50aad66 git |
Not specified |
| CNA |
Linux |
Linux |
affected 7c37c7e00411b3d1e0c5292368317aca69d1f324 6347c5314cee49f364aaf2e40ff15415a57a116e git |
Not specified |
| CNA |
Linux |
Linux |
affected 5.13 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.13 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.148 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.101 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.42 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.1.6 7.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2-rc5 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/c0936c131a71657afc635d0db2ab096d15d473e1 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/d536bf205c71f700f6de2086038c3e1d77724715 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/18506d7263768d76ac8e057ba55a4d9da50aad66 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/6347c5314cee49f364aaf2e40ff15415a57a116e |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.