CVE-2026-53211

A flaw was found in the Linux kernel's netfilter component, specifically in nft_meta_bridge. The NFT_META_BRI_IIFHWADDR register, intended for hardware address storage, is declared with a length of 6 bytes but is tracked as 8 bytes during initialization. When nft_meta_bridge_get_eval() writes to this register, only 6 bytes are written, leaving 2 bytes uninitialized. A subsequent operation that loads this register can leak these uninitialized stale stack bytes to userspace, leading to information disclosure.

This flaw is rated as Moderate severity because exploitation requires local privileges to define bridge netfilter rules and is limited to leaking small fragments of kernel stack memory without causing system crashes or enabling privilege escalation directly. On typical Red Hat Enterprise Linux deployments, netfilter bridge metadata evaluation is not engaged unless custom bridge filtering configurations are actively utilized. An authenticated local attacker with administrative network access, or operating within an unprivileged user namespace, could inspect residual stack contents to facilitate further attacks such as bypassing kernel layout randomization.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.