CVE-2026-53219

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: x_tables: avoid leaking percpu counter pointers<br /> <br /> The native and compat get-entries paths copy the fixed rule entry header<br /> from the kernelized rule blob to userspace before overwriting the entry&amp;#39;s<br /> counter fields with a sanitized counter snapshot.<br /> <br /> On SMP kernels, entry-&gt;counters.pcnt contains the percpu allocation<br /> address used by x_tables rule counters. A caller can provide a userspace<br /> buffer that faults during the initial fixed-header copy after pcnt has<br /> been copied but before the later sanitized counter copy runs. The syscall<br /> then returns -EFAULT while leaving the raw percpu pointer in userspace.<br /> <br /> Copy only the fixed entry prefix before counters from the kernelized rule<br /> blob, then copy the sanitized counter snapshot into the counter field.<br /> Apply this ordering to the IPv4, IPv6, and ARP native and compat<br /> get-entries implementations so a fault cannot expose the internal percpu<br /> counter pointer.