Information disclosure in Linux kernel - CVE-2026-53219
Published: June 26, 2026
Vulnerability identifier: #VU135565
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53219
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper handling of partially failed copy_to_user operations in x_tables get-entries implementations when copying rule entries to userspace. A local user can provide a userspace buffer that faults during the initial header copy to disclose sensitive information.
On SMP kernels, the leaked value is the internal percpu counter allocation pointer. The issue affects the IPv4, IPv6, and ARP native and compat get-entries paths.
How to mitigate CVE-2026-53219
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/08a3e218064db11f154ad9ad5541751ea7f34ebe
- https://git.kernel.org/stable/c/0b35dc8527ccc16b7dc34e8a3164313e68cd4e45
- https://git.kernel.org/stable/c/8d67e42ad3b1a95a152541015a07110e06992d6c
- https://git.kernel.org/stable/c/a0d16941adf3a501956d74aefd8d6e217906e79c
- https://git.kernel.org/stable/c/b28e2fcad3db7e8687b15bc20bced26b5b7c920e
- https://git.kernel.org/stable/c/b74ba3343eb44b2cbf7e9665918c287df1d52ebb
- https://git.kernel.org/stable/c/f7f2fbb0e893a0238dc464f8d8c0f5609bec584f
- https://git.kernel.org/stable/c/fb0521aff1e10e300d89725cc439d3ea74c828c5