{"id":4652,"date":"2026-09-04T18:46:40","date_gmt":"2026-09-04T10:46:40","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64576"},"modified":"2026-09-04T18:46:40","modified_gmt":"2026-09-04T10:46:40","slug":"cve-2026-64576","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64576","title":{"rendered":"CVE-2026-64576 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: initialize e"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nexthop: initialize extack in nh_res_bucket_migrate()<\/p>\n<p>nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to<br \/>\ncall_nexthop_res_bucket_notifiers(). When<br \/>\nnh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns<br \/>\n-ENOMEM), the error is propagated back before any notifier sets<br \/>\nextack._msg, and the error path formats the stale pointer with<br \/>\npr_err_ratelimited(&#8220;%sn&#8221;, extack._msg). With CONFIG_INIT_STACK_NONE<br \/>\nthis dereferences uninitialized stack memory:<\/p>\n<p>  Oops: general protection fault, probably for non-canonical address &#8230;<br \/>\n  KASAN: maybe wild-memory-access in range [&#8230;]<br \/>\n  RIP: 0010:string (lib\/vsprintf.c:730)<br \/>\n   vsnprintf (lib\/vsprintf.c:2945)<br \/>\n   _printk (kernel\/printk\/printk.c:2504)<br \/>\n   nh_res_bucket_migrate (net\/ipv4\/nexthop.c:1816)<br \/>\n   nh_res_table_upkeep (net\/ipv4\/nexthop.c:1866)<br \/>\n   rtm_new_nexthop (net\/ipv4\/nexthop.c:3323)<br \/>\n   rtnetlink_rcv_msg (net\/core\/rtnetlink.c:7076)<br \/>\n   netlink_sendmsg (net\/netlink\/af_netlink.c:1900)<br \/>\n  Kernel panic &#8211; not syncing: Fatal exception<\/p>\n<p>Zero-initialize extack so _msg is NULL on error paths that never set it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nexthop: initialize extack in nh_res_bucket_migrate()<\/p>\n<p>nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to<br \/>\ncall_next<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4652","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}