CVE-2026-53218

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_exthdr: fix register tracking for F_PRESENT flag

nft_exthdr_init() passes user-controlled priv->len to

nft_parse_register_store(), which marks that many bytes in the

register bitmap as initialized. However, when NFT_EXTHDR_F_PRESENT

is set, the eval paths write only 1 byte (nft_reg_store8) or

4 bytes (*dest = 0 on TCP/DCCP error path). When len > 4,

registers beyond the first are never written, retaining

uninitialized stack data from nft_regs.

Bail out if userspace requests too much data when F_PRESENT is set.