CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate()
In the Linux kernel, the following vulnerability has been resolved:
nexthop: initialize extack in nhresbucketmigrate()
nhresbucketmigrate() passes an uninitialized netlinkextack to callnexthopresbucketnotifiers(). When nhnotifierresbucketinfoinit() fails (e.g. the kzalloc returns -ENOMEM), the error is propagated back before any notifier sets extack.msg, and the error path formats the stale pointer with prerrratelimited("%s\n", extack.msg). With CONFIGINITSTACKNONE this dereferences uninitialized stack memory:
Oops: general protection fault, probably for non-canonical address ... KASAN: maybe wild-memory-access in range [...] RIP: 0010:string (lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) printk (kernel/printk/printk.c:2504) nhresbucketmigrate (net/ipv4/nexthop.c:1816) nhrestableupkeep (net/ipv4/nexthop.c:1866) rtmnewnexthop (net/ipv4/nexthop.c:3323) rtnetlinkrcvmsg (net/core/rtnetlink.c:7076) netlinksendmsg (net/netlink/afnetlink.c:1900) Kernel panic - not syncing: Fatal exception
Zero-initialize extack so msg is NULL on error paths that never set it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure CONFIG_INIT_STACK_NONE does not leave extack uninitialized on error paths; apply the kernel fix described as: zero-initialize extack so extack._msg is NULL on error paths that never set it (in nexthop/nh_res_bucket_migrate flow).
Linux kernel CONFIG_INIT_STACK_NONE = enabled - Configuration
Update the kernel code so that nh_res_bucket_migrate() initializes the netlink_ext_ack/extack structure; this prevents stale pointers from being dereferenced by pr_err_ratelimited("%s\n", extack._msg) and vsnprintf in error formatting.
Linux kernel extack initialization in nh_res_bucket_migrate() = zero-initialize extack so extack._msg is NULL on error paths
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64576?
CVE-2026-64576 has a risk score of 50, indicating a moderate severity level.
How do I fix CVE-2026-64576?
To fix CVE-2026-64576, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What does CVE-2026-64576 affect?
CVE-2026-64576 affects the Linux kernel through a potential issue in the nexthop module involving uninitialized netlink_ext_ack.
When was CVE-2026-64576 published?
CVE-2026-64576 was published on August 5, 2026.
What component of the Linux kernel is involved in CVE-2026-64576?
CVE-2026-64576 involves the nexthop component of the Linux kernel.