CVE-2026-64576 Overview
CVE-2026-64576 is an uninitialized memory use vulnerability in the Linux kernel's IPv4 nexthop subsystem. The flaw resides in nh_res_bucket_migrate() in net/ipv4/nexthop.c, which passes an uninitialized netlink_ext_ack structure to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails with an allocation error such as -ENOMEM, the error path formats the stale extack._msg pointer via pr_err_ratelimited(). On kernels built with CONFIG_INIT_STACK_NONE, this dereferences uninitialized stack memory and triggers a general protection fault, leading to a kernel panic.
Critical Impact
Triggering the error path causes a kernel panic (Fatal exception), producing a denial-of-service condition on affected Linux hosts.
Affected Products
- Linux kernel (mainline) — net/ipv4/nexthop.c implementation of nexthop resilient buckets
- Stable branches referenced by kernel.org fix commits 18506d72, 3081702e, 6347c531, c0936c13, and d536bf20
- Kernels built with CONFIG_INIT_STACK_NONE where stack variables are not auto-initialized
Discovery Timeline
- 2026-08-05 - CVE-2026-64576 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-64576
Vulnerability Analysis
The defect is an uninitialized memory use bug [CWE-908] in the nexthop resilient hashing code. The function nh_res_bucket_migrate() declares a local struct netlink_ext_ack extack without zero-initializing it. It then calls call_nexthop_res_bucket_notifiers(), which in turn invokes nh_notifier_res_bucket_info_init() to allocate notifier state. When that initializer returns an error before any downstream notifier writes to extack._msg, control returns to the caller with the extack contents still holding whatever garbage the stack frame contained.
The error path then executes pr_err_ratelimited("%s\n", extack._msg), treating the uninitialized field as a valid pointer to a NUL-terminated string. On kernels compiled with CONFIG_INIT_STACK_NONE, no compiler-driven zeroing occurs, and the pointer resolves to a non-canonical address. KASAN reports a wild memory access, and the kernel oopses with a general protection fault inside string() and vsnprintf() in lib/vsprintf.c.
Root Cause
The root cause is missing initialization of a stack-allocated struct netlink_ext_ack combined with an error path that unconditionally reads extack._msg. The kernel relies on notifiers to populate the field, but early allocation failures short-circuit that contract while still exercising the print path.
Attack Vector
Reaching the vulnerable code path requires the ability to send RTM_NEWNEXTHOP netlink messages that drive rtm_new_nexthop() into nh_res_table_upkeep() and then nh_res_bucket_migrate(). Netlink operations of this class typically require CAP_NET_ADMIN. The crash is reproducible under memory pressure or fault injection that makes the internal kzalloc return -ENOMEM, resulting in a kernel panic and host denial of service.
No verified public exploit code is available. Refer to the upstream fix commits linked in the Kernel Git Commit Log for the exact patch that zero-initializes extack.
Detection Methods for CVE-2026-64576
Indicators of Compromise
- Kernel oops messages referencing nh_res_bucket_migrate and nh_res_table_upkeep with general protection fault, probably for non-canonical address
- KASAN reports of wild-memory-access inside string/vsnprintf originating from _printk in kernel/printk/printk.c
- Kernel panic - not syncing: Fatal exception events correlated with recent RTM_NEWNEXTHOP netlink activity
Detection Strategies
- Monitor dmesg and journald for oops signatures whose call stack includes nh_res_bucket_migrate followed by rtnetlink_rcv_msg and netlink_sendmsg.
- Alert on unexpected kernel panics on routers, load balancers, and hosts that use IPv4 resilient nexthop groups.
- Audit processes holding CAP_NET_ADMIN that issue nexthop netlink operations, particularly on kernels built with CONFIG_INIT_STACK_NONE.
Monitoring Recommendations
- Forward kernel logs to a centralized store and build detections for the specific RIP symbol nh_res_bucket_migrate in crash traces.
- Track kernel version and CONFIG_INIT_STACK_* build options across the fleet to prioritize vulnerable hosts.
- Correlate netlink audit records (audit/nftables) with subsequent host reboots to identify triggering workloads.
How to Mitigate CVE-2026-64576
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 18506d7263768d76ac8e057ba55a4d9da50aad66, 3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d, 6347c5314cee49f364aaf2e40ff15415a57a116e, c0936c131a71657afc635d0db2ab096d15d473e1, and d536bf205c71f700f6de2086038c3e1d77724715.
- Restrict CAP_NET_ADMIN and nexthop configuration privileges to trusted administrators and orchestration components.
- Rebuild affected kernels with CONFIG_INIT_STACK_ALL_ZERO where feasible to neutralize similar uninitialized-stack defects.
Patch Information
The fix zero-initializes the netlink_ext_ack structure inside nh_res_bucket_migrate() so that _msg is NULL on error paths that never assign it, allowing pr_err_ratelimited() to render the missing string safely. Distribution kernels should pick up the stable backports referenced in the Kernel Git Commit Log. Consult your distribution's security tracker for the exact package version that carries the backport.
Workarounds
- Avoid using IPv4 resilient nexthop groups on unpatched kernels where nexthop reconfiguration can be driven by lower-privileged tenants.
- Constrain memory-pressure conditions on network control-plane hosts so that internal kzalloc failures in the notifier path are less likely to occur.
- Rebuild kernels with automatic stack variable initialization enabled to blunt exploitation of related uninitialized-memory bugs.
# Verify running kernel and stack-init configuration
uname -r
grep -E 'CONFIG_INIT_STACK_(NONE|ALL_ZERO|ALL_PATTERN)' /boot/config-$(uname -r)
# Restrict nexthop netlink capability to specific admin users only
# (example: drop CAP_NET_ADMIN from an unprivileged service unit)
systemctl edit my-network-agent.service
# In the drop-in, add:
# [Service]
# CapabilityBoundingSet=~CAP_NET_ADMIN
# AmbientCapabilities=
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
