CVE-2026-53134

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_fib: fix stale stack leak via the OIFNAME register

For NFT_FIB_RESULT_OIFNAME the destination register is declared with

len = IFNAMSIZ (four 32-bit registers), but on the lookup-fail,

RTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one

register via "*dest = 0". The remaining three registers are left as

whatever was on the stack in nft_do_chain()'s struct nft_regs, and a

downstream expression that loads the register span can leak that

uninitialised kernel stack to userspace.

The NFTA_FIB_F_PRESENT existence check has the same shape: it is only

meaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type

while the eval stores a single byte via nft_reg_store8(), leaving the rest

of the declared span stale.

Fix both:

- replace the bare "*dest = 0" in the eval with nft_fib_store_result(),

which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already

used on the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References