CVE-2026-64576

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nexthop: initialize extack in nh_res_bucket_migrate()<br /> <br /> nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to<br /> call_nexthop_res_bucket_notifiers(). When<br /> nh_notifier_res_bucket_info_init() fails (e.g. the kzalloc returns<br /> -ENOMEM), the error is propagated back before any notifier sets<br /> extack._msg, and the error path formats the stale pointer with<br /> pr_err_ratelimited("%s\n", extack._msg). With CONFIG_INIT_STACK_NONE<br /> this dereferences uninitialized stack memory:<br /> <br /> Oops: general protection fault, probably for non-canonical address ...<br /> KASAN: maybe wild-memory-access in range [...]<br /> RIP: 0010:string (lib/vsprintf.c:730)<br /> vsnprintf (lib/vsprintf.c:2945)<br /> _printk (kernel/printk/printk.c:2504)<br /> nh_res_bucket_migrate (net/ipv4/nexthop.c:1816)<br /> nh_res_table_upkeep (net/ipv4/nexthop.c:1866)<br /> rtm_new_nexthop (net/ipv4/nexthop.c:3323)<br /> rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)<br /> netlink_sendmsg (net/netlink/af_netlink.c:1900)<br /> Kernel panic - not syncing: Fatal exception<br /> <br /> Zero-initialize extack so _msg is NULL on error paths that never set it.