CVE-2026-52937

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description A stack information leak exists in the tap ioctl() function during the SIOCGIFHWADDR path. The function copies 16 bytes of an uninitialized on-stack sockaddr storage structure to userspace via ifr hwaddr. However, netif get mac address() only writes the sa family and dev->addr len (6 bytes for Ethernet) bytes, leaving sa data[6..13] uninitialized. These 8 trailing bytes leak kernel stack contents; specifically, SIOCGIFHWADDR on a macvtap chardev returns kernel .text and direct-map pointers, which defeats KASLR (Kernel Address Space Layout Randomization), a security feature that randomizes the memory addresses used by the kernel to make exploitation more difficult.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.