CVE-2026-53134: Linux Kernel Information Disclosure Flaw

CVE-2026-53134 Overview

CVE-2026-53134 is a kernel information disclosure vulnerability in the Linux netfilter subsystem, specifically within the nft_fib expression module. The flaw allows leakage of uninitialized kernel stack memory to userspace through the OIFNAME register. When nft_fib{4,6}_eval() handles lookup-fail, RTN_LOCAL, or output-interface-mismatch paths, it writes only a single 32-bit register via *dest = 0 instead of the full IFNAMSIZ span declared for the destination register. A downstream expression loading that register span can expose stale stack contents from nft_do_chain()'s struct nft_regs.

Critical Impact
Local users with the ability to load nftables rules can read uninitialized kernel stack memory, potentially disclosing sensitive data such as pointers useful for bypassing Kernel Address Space Layout Randomization (KASLR).

Affected Products

Linux kernel netfilter subsystem (nft_fib expression)
Linux kernel nft_fib4 and nft_fib6 modules
Distributions shipping affected upstream kernel versions prior to the listed stable patches

Discovery Timeline

2026-06-25 - CVE CVE-2026-53134 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53134

Vulnerability Analysis

The vulnerability resides in the netfilter nft_fib expression, which performs Forwarding Information Base (FIB) lookups for nftables rules. For NFT_FIB_RESULT_OIFNAME, the destination register is declared with len = IFNAMSIZ, which spans four 32-bit registers. Three early-return code paths inside nft_fib4_eval() and nft_fib6_eval() — lookup failure, RTN_LOCAL matches, and output-interface mismatches — clear only the first register by writing *dest = 0. The remaining three registers retain whatever values existed on the kernel stack within nft_do_chain()'s struct nft_regs structure. This represents an Uninitialized Memory Use condition leading to Information Disclosure.

A related issue affects the NFTA_FIB_F_PRESENT existence check. The flag is only meaningful for NFT_FIB_RESULT_OIF but was accepted for any result type. The evaluator writes a single byte via nft_reg_store8(), leaving the remainder of the declared register span stale and readable.

Root Cause

The root cause is incomplete initialization of a multi-register destination span. The eval function assumes a single-register zero write is sufficient when the register descriptor declares a larger span. The mismatch between the declared register width (IFNAMSIZ) and the actual bytes written (4 bytes) leaves between 12 and 15 bytes of kernel stack memory exposed depending on the path taken.

Attack Vector

Exploitation requires the ability to load nftables rules, which generally implies CAP_NET_ADMIN within a user or network namespace. An attacker constructs an nftables ruleset that invokes nft_fib with NFT_FIB_RESULT_OIFNAME, forces one of the early-return paths, and then uses a subsequent expression to read or compare the full register span. The recovered bytes can be exfiltrated by observing rule match outcomes or by copying register contents to a userspace-accessible structure.

No verified public exploit code is available. See the upstream commits referenced below for the exact code paths involved.

Detection Methods for CVE-2026-53134

Indicators of Compromise

Unprivileged or container-spawned processes creating nftables rulesets that combine fib expressions with register-load expressions reading more than 4 bytes of the result.
User namespace creation by non-root users immediately followed by nft or libnftnl syscall activity (NFNL_SUBSYS_NFTABLES).
Unusual CAP_NET_ADMIN acquisition patterns from non-administrative workloads on production hosts.

Detection Strategies

Monitor kernel auditd events for nf_tables netlink messages issued by non-privileged users or short-lived containers.
Track unshare() and clone() calls using CLONE_NEWUSER followed by CLONE_NEWNET from processes not normally requiring namespace isolation.
Correlate nftables rule installations referencing fib and oifname lookups with subsequent register-comparison expressions of length greater than 4.

Monitoring Recommendations

Enable Linux audit rules for the nf_tables syscall family and forward events to a centralized analytics platform for behavioral analysis.
Inventory running kernel versions across the fleet and flag hosts running unpatched releases identified in the upstream stable tree advisories.
Alert on container workloads that load custom nftables rules outside of orchestrator-managed network policy controllers.

How to Mitigate CVE-2026-53134

Immediate Actions Required

Update affected systems to a Linux kernel release containing the upstream fix referenced by the stable commits listed in the patch information section.
Restrict CAP_NET_ADMIN inside user namespaces by setting kernel.unprivileged_userns_clone = 0 where unprivileged namespaces are not required.
Audit container runtime configurations to confirm that workloads do not unnecessarily receive NET_ADMIN capability.

Patch Information

The fix replaces the bare *dest = 0 write in the eval function with nft_fib_store_result(), which uses strscpy_pad() to zero the entire IFNAMSIZ span for OIFNAME. The patch also restricts NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declares its destination as a single u8, matching the one byte written by the evaluator. Upstream stable backports are tracked in commits 3544210609, 6744e49fe5, 84d8f58cf2, 8c84885e97, ab185e0c4f, d19ddef8c3, eb8a812448, and eca18feed3.

Workarounds

Disable unprivileged user namespaces on hosts that do not require them, removing the primary path by which unprivileged users obtain CAP_NET_ADMIN.
Use Linux Security Modules such as SELinux or AppArmor to deny nf_tables netlink access to workloads that do not need to manage firewall rules.
Block loading of the nf_tables module on systems that rely exclusively on legacy iptables or have no firewall ruleset requirements.

bash

# Configuration example
# Disable unprivileged user namespaces (requires reboot or sysctl reload)
echo 'kernel.unprivileged_userns_clone = 0' | sudo tee /etc/sysctl.d/99-cve-2026-53134.conf
sudo sysctl --system

# Verify current kernel version against patched stable releases
uname -r