CVE-2026-64576nexthop: initialize extack in nh_res_bucket_migrate()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns -ENOMEM), the error is propagated back before any notifier sets extack._msg, and the error path formats the stale pointer with pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE this dereferences uninitialized stack memory: Oops: general protection fault, probably for non-canonical address ... KASAN: maybe wild-memory-access in range [...] RIP: 0010:string (lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) _printk (kernel/printk/printk.c:2504) nh_res_bucket_migrate (net/ipv4/nexthop.c:1816) nh_res_table_upkeep (net/ipv4/nexthop.c:1866) rtm_new_nexthop (net/ipv4/nexthop.c:3323) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) netlink_sendmsg (net/netlink/af_netlink.c:1900) Kernel panic - not syncing: Fatal exception Zero-initialize extack so _msg is NULL on error paths that never set it.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7c37c7e00411b3d1e0c5292368317aca69d1f324 before eacd2e2117e8682f937967fda1022e7f1c22d91a; from 7c37c7e00411b3d1e0c5292368317aca69d1f324 before 37bbd7e1d8df0bec3d187e961783e20c30533d2c; from 7c37c7e00411b3d1e0c5292368317aca69d1f324 before c0936c131a71657afc635d0db2ab096d15d473e1; from 7c37c7e00411b3d1e0c5292368317aca69d1f324 before 3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d; from 7c37c7e00411b3d1e0c5292368317aca69d1f324 before d536bf205c71f700f6de2086038c3e1d77724715; from 7c37c7e00411b3d1e0c5292368317aca69d1f324 before 18506d7263768d76ac8e057ba55a4d9da50aad66; from 7c37c7e00411b3d1e0c5292368317aca69d1f324 before 6347c5314cee49f364aaf2e40ff15415a57a116e | CNA record |
References
- https://git.kernel.org/stable/c/eacd2e2117e8682f937967fda1022e7f1c22d91a
- https://git.kernel.org/stable/c/37bbd7e1d8df0bec3d187e961783e20c30533d2c
- https://git.kernel.org/stable/c/c0936c131a71657afc635d0db2ab096d15d473e1
- https://git.kernel.org/stable/c/3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d
- https://git.kernel.org/stable/c/d536bf205c71f700f6de2086038c3e1d77724715
- https://git.kernel.org/stable/c/18506d7263768d76ac8e057ba55a4d9da50aad66
- https://git.kernel.org/stable/c/6347c5314cee49f364aaf2e40ff15415a57a116e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.