---
id: CVE-2026-64576
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nexthop: initialize extack in nh_res_bucket_migrate()

  nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to
  call_nexthop_res_bucket_notifiers()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nexthop: initialize extack in nh_res_bucket_migrate()

  nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to
  call_nexthop_res_bucket_notifiers(). When
  nh_n…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
published: '2026-08-05'
updated: '2026-08-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64576'
references:
  - url: 'https://git.kernel.org/stable/c/18506d7263768d76ac8e057ba55a4d9da50aad66'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6347c5314cee49f364aaf2e40ff15415a57a116e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c0936c131a71657afc635d0db2ab096d15d473e1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d536bf205c71f700f6de2086038c3e1d77724715'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eacd2e2117e8682f937967fda1022e7f1c22d91a'
  - url: 'https://git.kernel.org/stable/c/37bbd7e1d8df0bec3d187e961783e20c30533d2c'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64576.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64576'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2511419'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64576'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64576'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026080524-CVE-2026-64576-38cf@gregkh/T
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00121
epssPercentile: 0.01922
ingestedAt: '2026-08-08T20:29:49.353Z'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7c37c7e00411b3d1e0c5292368317aca69d1f324 <
    eacd2e2117e8682f937967fda1022e7f1c22d91a
  - >-
    Linux >= 7c37c7e00411b3d1e0c5292368317aca69d1f324 <
    37bbd7e1d8df0bec3d187e961783e20c30533d2c
  - >-
    Linux >= 7c37c7e00411b3d1e0c5292368317aca69d1f324 <
    c0936c131a71657afc635d0db2ab096d15d473e1
  - >-
    Linux >= 7c37c7e00411b3d1e0c5292368317aca69d1f324 <
    3081702ea5aca0aeed9c1ade8eadf6cde8db6b7d
  - >-
    Linux >= 7c37c7e00411b3d1e0c5292368317aca69d1f324 <
    d536bf205c71f700f6de2086038c3e1d77724715
  - >-
    Linux >= 7c37c7e00411b3d1e0c5292368317aca69d1f324 <
    18506d7263768d76ac8e057ba55a4d9da50aad66
  - >-
    Linux >= 7c37c7e00411b3d1e0c5292368317aca69d1f324 <
    6347c5314cee49f364aaf2e40ff15415a57a116e
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:43:11.555389Z'
cwe:
  - CWE-824
scores:
  nvd: 7.1
  vendor: 5.5
  cna: 7.1
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nexthop: initialize extack in nh_res_bucket_migrate()

nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to
call_nexthop_res_bucket_notifiers(). When
nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns
-ENOMEM), the error is propagated back before any notifier sets
extack._msg, and the error path formats the stale pointer with
pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE
this dereferences uninitialized stack memory:

  Oops: general protection fault, probably for non-canonical address ...
  KASAN: maybe wild-memory-access in range [...]
  RIP: 0010:string (lib/vsprintf.c:730)
   vsnprintf (lib/vsprintf.c:2945)
   _printk (kernel/printk/printk.c:2504)
   nh_res_bucket_migrate (net/ipv4/nexthop.c:1816)
   nh_res_table_upkeep (net/ipv4/nexthop.c:1866)
   rtm_new_nexthop (net/ipv4/nexthop.c:3323)
   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)
   netlink_sendmsg (net/netlink/af_netlink.c:1900)
  Kernel panic - not syncing: Fatal exception

Zero-initialize extack so _msg is NULL on error paths that never set it.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64576.json)