CVE-2026-52937 Details
Description
In the Linux kernel, the following vulnerability has been resolved: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an uninitialised on-stack struct sockaddr_storage to userspace via ifr_hwaddr, but netif_get_mac_address() only writes sa_family and dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised. Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a macvtap chardev returns kernel .text and direct-map pointers, defeating KASLR. Initialise ss at declaration.
A stack information leak vulnerability has been identified in the Linux kernel's tap_ioctl() function, specifically in the SIOCGIFHWADDR path. The issue arises because tap_ioctl() copies 16 bytes of an uninitialized on-stack struct sockaddr_storage to userspace via ifr_hwaddr. However, netif_get_mac_address() only populates sa_family and dev->addr_len (6 bytes for Ethernet), leaving the sa_data[6..13] bytes uninitialized. This gap allows leakage of kernel stack contents; when SIOCGIFHWADDR is called on a macvtap character device, it returns pointers to the kernel .text and direct-map areas, bypassing Kernel Address Space Layout Randomization (KASLR). The vulnerability has been addressed by initializing the sockaddr_storage structure at the time of declaration.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/05305e832be7b9d65b2b72caacf7d850b3942b2a | kernel.org | Patch |
| https://git.kernel.org/stable/c/719007c3492f0f1f9e9cdbed8ac45ba45bb13eeb | kernel.org | Patch |
| https://git.kernel.org/stable/c/bddc09212c24934643bd44fc794748d2bbb3b6cd | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.4.103, < 5.5 >= 5.10.21, < 5.11 >= 5.11.4, < 6.18.34 >= 6.19, < 7.0.11 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | New CVE Received | kernel.org |