CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftexthdr: fix register tracking for FPRESENT flag
nftexthdrinit() passes user-controlled priv->len to nftparseregisterstore(), which marks that many bytes in the register bitmap as initialized. However, when NFTEXTHDRFPRESENT is set, the eval paths write only 1 byte (nftregstore8) or 4 bytes (dest = 0 on TCP/DCCP error path). When len > 4, registers beyond the first are never written, retaining uninitialized stack data from nftregs.
Bail out if userspace requests too much data when FPRESENT is set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Fix register tracking for the NFT_EXTHDR_F_PRESENT flag so that registers marked initialized in the bitmap match the bytes actually written on the eval path (e.g., when len > 4 and only 1 byte is written).
netfilter: nft_exthdr F_PRESENT handling (priv->len passed to nft_parse_register_store) = Ensure register tracking is corrected when NFT_EXTHDR_F_PRESENT is set (do not mark beyond bytes actually written as initialized) - Compensating control
Bail out if userspace requests too much data when F_PRESENT is set.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53218?
CVE-2026-53218 has a severity rating of high, categorized as a 7 on the CVSS scale.
How do I fix CVE-2026-53218?
To fix CVE-2026-53218, update the Linux kernel to the latest version where this vulnerability has been patched.
What systems are affected by CVE-2026-53218?
CVE-2026-53218 affects the Linux kernel, specifically the netfilter nft_exthdr components.
What are the potential impacts of exploiting CVE-2026-53218?
Exploiting CVE-2026-53218 could allow an attacker to interact with the register bitmap in unintended ways, potentially leading to privilege escalation.
How was CVE-2026-53218 discovered?
CVE-2026-53218 was identified during a review of register tracking in the nft_exthdr component of the Linux kernel.