CVE-2026-53134

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stale stack leak exists in the netfilter nft fib component. When using the NFT FIB RESULT OIFNAME result type, the destination register is declared with a length of IFNAMSIZ, but certain paths in the nft fib{4,6} eval() function only write to a single register. This leaves the remaining three registers containing uninitialized data from the struct nft regs on the stack, which can be leaked to userspace by a downstream expression. Similarly, the NFTA FIB F PRESENT existence check was accepted for any result type while only storing a single byte via nft reg store8(), leaving the rest of the declared span stale.

Recommendations As a temporary mitigation, restrict the use of the NFT FIB RESULT OIFNAME register and the NFTA FIB F PRESENT check until the system is updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.