Answer in brief
CVE-2026-64576 records a High severity (CVSS 7.1) vulnerability in nexthop: initialize extack in nh_res_bucket_migrate(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 5.13 | Not reported |
| Linux/Linuxgeneric | >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <c0936c131a71657afc635d0db2ab096d15d473e1 || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <d536bf205c71f700f6de2086038c3e1d77724715 || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <18506d7263768d76ac8e057ba55a4d9da50aad66 || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <6347c5314cee49f364aaf2e40ff15415a57a116e | c0936c131a71657afc635d0db2ab096d15d473e1, 3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d, d536bf205c71f700f6de2086038c3e1d77724715, 18506d7263768d76ac8e057ba55a4d9da50aad66, 6347c5314cee49f364aaf2e40ff15415a57a116e |
| Linux/Linuxgeneric | >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <eacd2e2117e8682f937967fda1022e7f1c22d91a || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <37bbd7e1d8df0bec3d187e961783e20c30533d2c || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <c0936c131a71657afc635d0db2ab096d15d473e1 || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <d536bf205c71f700f6de2086038c3e1d77724715 || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <18506d7263768d76ac8e057ba55a4d9da50aad66 || >=7c37c7e00411b3d1e0c5292368317aca69d1f324 <6347c5314cee49f364aaf2e40ff15415a57a116e | eacd2e2117e8682f937967fda1022e7f1c22d91a, 37bbd7e1d8df0bec3d187e961783e20c30533d2c, c0936c131a71657afc635d0db2ab096d15d473e1, 3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d, d536bf205c71f700f6de2086038c3e1d77724715, 18506d7263768d76ac8e057ba55a4d9da50aad66, 6347c5314cee49f364aaf2e40ff15415a57a116e |
Published upstream
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns -ENOMEM), the error is propagated back before any notifier sets extack._msg, and the error path formats the stale pointer with pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE this dereferences uninitialized stack memory: Oops: general protection fault, probably for non-canonical address ... KASAN: maybe wild-memory-access in range [...] RIP: 0010:string (lib/vsprintf.c:730) vsnprintf (lib/vsprintf.c:2945) _printk (kernel/printk/printk.c:2504) nh_res_bucket_migrate (net/ipv4/nexthop.c:1816) nh_res_table_upkeep (net/ipv4/nexthop.c:1866) rtm_new_nexthop (net/ipv4/nexthop.c:3323) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) netlink_sendmsg (net/netlink/af_netlink.c:1900) Kernel panic - not syncing: Fatal exception Zero-initialize extack so _msg is NULL on error paths that never set it.
Quoted source text, attributed separately from HOL analysis.