CVE-2026-64576

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nexthop: initialize extack in nh_res_bucket_migrate()

nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to

call_nexthop_res_bucket_notifiers(). When

nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns

-ENOMEM), the error is propagated back before any notifier sets

extack._msg, and the error path formats the stale pointer with

pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE

this dereferences uninitialized stack memory:

Oops: general protection fault, probably for non-canonical address ...

KASAN: maybe wild-memory-access in range [...]

RIP: 0010:string (lib/vsprintf.c:730)

vsnprintf (lib/vsprintf.c:2945)

_printk (kernel/printk/printk.c:2504)

nh_res_bucket_migrate (net/ipv4/nexthop.c:1816)

nh_res_table_upkeep (net/ipv4/nexthop.c:1866)

rtm_new_nexthop (net/ipv4/nexthop.c:3323)

rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)

netlink_sendmsg (net/n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References