nexthop: initialize extack in nh_res_bucket_migrate()
CVSS score
7.1
EPSS probability
%0.1
Risk score
0.0
Published
2 mo ago
Kanıt listesindeki ürün ve sürüm eşleşmesini kontrol edin; bazı varyantlar hâlâ etkileniyor olabilir.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
2
Source agreement
Tam uyum
Evidence confidence
%58
Short explanation
CVE-2026-64576 is a memory safety issue in the Linux kernel where an uninitialized netlink_ext_ack is used in error handling. It only affects specific kernel versions and is mitigated by proper initialization and kernel updates. No exploit is known, and CVSS scoring is unavailable. The vulnerability is resolved by patching the kernel with zero-initialization of extack._msg in error paths.
This vulnerability highlights a critical memory safety flaw in kernel code that could lead to system crashes or arbitrary code execution under specific conditions. While not actively exploited, it underscores the importance of proper initialization and secure coding practices in kernel development.
What should be done?
- Update to a kernel version after 7c37c7e00411b3d1e0c5292368317aca69d1f324
- Ensure CONFIG_INIT_STACK_NONE is disabled if not required
The sources give limited detail on some technical conditions. Review the chain of evidence below before deciding how to act.
Chain of evidence and sources
CVE-2026-64576, Linux çekirdeğinde nh_res_bucket_migrate() işlevinin netlink_ext_ack'ı başlatılmadan call_nexthop_res_bucket_notifiers()'a geçmesiyle oluşur. CONFIG_INIT_STACK_NONE etkinse, bu durum genel koruma hatası ya da çekirdek panikine neden olur.
Bu ele geçirme, 7c37c7e00411b3d1e0c5292368317aca69d1f324'ten önceki Linux çekirdeği sürümlerine etki eder ve c0936c131a71657afc635d0db2ab096d15d473e1, 3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d, d536bf205c71f700f6de2086038c3e1d77724715, 18506d7263768d76ac8e057ba55a4d9da50aad66 ve 6347c5314cee49f364aaf2e40ff15415a57a116e gibi belirli aralıklar etkilenir.
5.13 ve sonrası, 6.6.148+, 6.12.101+, 6.18.42+, veya 7.1.6+ sürümler etkilenmez.
CVE-2026-64576 için CVSS puanı mevcut değildir ve bu ele geçirme için bilinen bir saldırı veya aktif tehdit yoktur.
Düzelme, hataya karşı olan yollar için extack._msg alanını sıfırlayarak, başlatılmamış bellek kullanımını önler.
Show the technical text from the sources
In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns -ENOMEM), the error is propagated back before any notifier sets extack._msg, and the error path formats the stale pointer with pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE this dereferences uninitialized stack memory: Oops: general protection fault, probably for non-canonical address ... KASAN: maybe wild-memory-access in range [...] RIP: 0010:string (lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) _printk (kernel/printk/printk.c:2504) nh_res_bucket_migrate (net/ipv4/nexthop.c:1816) nh_res_table_upkeep (net/ipv4/nexthop.c:1866) rtm_new_nexthop (net/ipv4/nexthop.c:3323) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) netlink_sendmsg (net/netlink/af_netlink.c:1900) Kernel panic - not syncing: Fatal exception Zero-initialize extack so _msg is NULL on error paths that never set it.
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Explanation produced with the local qwen3:4b-instruct model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-64576 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 7.1 | CVSS V31 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD |
| 7.1 | CVSS V3_1 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | CVE CNA |
| 4.1 | CVSS 3.x | — | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H | Microsoft MSRC |
Patch and Remediation Guide
Solution & Remediation Advisory
2 düzeltme kanıtı bulundu; en az 3 ürün veya sürüm hâlâ etkileniyor ya da inceleniyor.
7.1.6-1Debian sid: 7.1.6-1
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-64576 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-64576 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-64576"