CVE-2026-53218

netfilter: nft_exthdr: fix register tracking for F_PRESENT flag

State: Published
Severity: Not scored
Published: Jun 25, 2026
Updated: Oct 15, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_exthdr: fix register tracking for F_PRESENT flag

nft_exthdr_init() passes user-controlled priv->len to nft_parse_register_store(), which marks that many bytes in the register bitmap as initialized. However, when NFT_EXTHDR_F_PRESENT is set, the eval paths write only 1 byte (nft_reg_store8) or 4 bytes (*dest = 0 on TCP/DCCP error path). When len > 4, registers beyond the first are never written, retaining uninitialized stack data from nft_regs.

Bail out if userspace requests too much data when F_PRESENT is set.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 8738b1b6d0e639ca1fc0f61516afd3557ac4ecc6Affected c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 19748967d59c31d24d21d40b728570788310b237Affected c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 46fc15a044e9938e7ea77786fb37edd2cd74f031Affected c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before cd513e43b4b2bd1de39e2367bc4261c699a8652fAffected c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 67b27434c43b68a97becda98c9f0c8cf6cba2134Affected c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 78069a6d8bc86c9e036eb82c2af4a19cc1871a53Affected c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before f08fb3d42fd3aad0b7a263da3ac3ebaf0845e265Affected c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 772cecf198da732faebb5dcfc46d66a505be8495Affected
LinuxLinux	4.11Affected before 4.11Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 8738b1b6d0e639ca1fc0f61516afd3557ac4ecc6Affected
c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 19748967d59c31d24d21d40b728570788310b237Affected
c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 46fc15a044e9938e7ea77786fb37edd2cd74f031Affected
c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before cd513e43b4b2bd1de39e2367bc4261c699a8652fAffected
c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 67b27434c43b68a97becda98c9f0c8cf6cba2134Affected
c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 78069a6d8bc86c9e036eb82c2af4a19cc1871a53Affected
c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before f08fb3d42fd3aad0b7a263da3ac3ebaf0845e265Affected
c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 to before 772cecf198da732faebb5dcfc46d66a505be8495Affected

LinuxLinux

4.11Affected
before 4.11Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.