CVE-2026-53218 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
A local attacker can read uninitialized kernel stack memory via netfilter nft_exthdr when the F_PRESENT flag is used with large lengths.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53218?
CVE-2026-53218 is a medium-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
nft_exthdr_init() passes user-controlled priv->len to nft_parse_register_store(), which marks that many bytes in the register bitmap as initialized. However, when NFT_EXTHDR_F_PRESENT is set, the eval paths write only 1 byte (nft_reg_store8) or 4 bytes (*dest = 0 on TCP/DCCP error path). When len > 4, registers beyond the first are never written, retaining uninitialized stack data from nft_regs.
Bail out if userspace requests too much data when F_PRESENT is set.
Weakness: CWE-908
Which versions are affected by CVE-2026-53218?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53218?
Apply the vendor's patch.
Is CVE-2026-53218 being exploited?
There is no known exploitation of CVE-2026-53218 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90353, BELL-CVE-2026-53218, DEBIAN-CVE-2026-53218, GHSA-3j78-pf43-6mvq, ROOT-OS-DEBIAN-11-CVE-2026-53218, ROOT-OS-DEBIAN-12-CVE-2026-53218 and 3 more.