CVE-2026-52937 tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
An attacker can read uninitialized kernel stack memory via SIOCGIFHWADDR on macvtap devices, potentially bypassing KASLR protections.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52937?
CVE-2026-52937 is a medium-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an uninitialised on-stack struct sockaddr_storage to userspace via ifr_hwaddr, but netif_get_mac_address() only writes sa_family and dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.
Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a macvtap chardev returns kernel .text and direct-map pointers, defeating KASLR.
Initialise ss at declaration.
Weakness: CWE-401
Which versions are affected by CVE-2026-52937?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-52937?
Apply the vendor's patch.
Is CVE-2026-52937 being exploited?
There is no known exploitation of CVE-2026-52937 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90387, BELL-CVE-2026-52937, DEBIAN-CVE-2026-52937, GHSA-2xmc-f6qc-h4h9, ROOT-OS-DEBIAN-11-CVE-2026-52937, ROOT-OS-DEBIAN-12-CVE-2026-52937 and 4 more.