CVE-2026-64576

A flaw was found in the Linux kernel. During nexthop resolution, an uninitialized variable is used if a memory allocation fails. This can lead to the system attempting to access uninitialized stack memory, causing a general protection fault and a kernel panic. This vulnerability results in a Denial of Service (DoS) on the affected system.

A flaw was found in the Linux kernel's nexthop subsystem that leads to a local denial of service with moderate impact. When a local user with network administration privileges (CAP_NET_ADMIN) performs a resilient nexthop bucket migration through the rtnetlink interface, nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack structure to the nexthop notifier call chain. If the notifier information initialization then fails, for example when a memory allocation returns -ENOMEM, the error path formats the uninitialized extack._msg pointer as a string in a rate-limited kernel log message, dereferencing uninitialized stack memory. This can cause a general protection fault and a kernel panic, resulting in a denial of service of the affected system.

Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in their kernels. Red Hat Enterprise Linux 9 (kernel and kernel-rt), Red Hat Enterprise Linux 10 (kernel), and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected. The fix for these products is currently deferred to a future update: the flaw has low practical exploitability because it requires local privileged access to the rtnetlink control plane, and triggering it additionally requires a memory allocation failure on a specific error path, which an attacker cannot reliably induce. The residual risk is that a local privileged user who manages to trigger the faulty error path could panic the system and cause a denial of service.

Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record assigns a higher score of 7.1 by including a high confidentiality impact. The available technical evidence shows only a denial-of-service primitive, an uninitialized pointer read formatted for a kernel log message, with no demonstrated information disclosure, so Red Hat assesses the confidentiality impact as none.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.