Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53219— netfilter: x_tables: avoid leaking percpu counter pointers

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于x_tables中泄漏percpu计数器指针，可能导致内部percpu计数器指针暴露。

AI Predicted 5.5 Difficulty: Hard EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 71ae0dff02d756e4d2ca710b79f2ff5390029a5f< b74ba3343eb44b2cbf7e9665918c287df1d52ebb affected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< 0b35dc8527ccc16b7dc34e8a3164313e68cd4e45 affected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< b28e2fcad3db7e8687b15bc20bced26b5b7c920e affected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< a0d16941adf3a501956d74aefd8d6e217906e79c affected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< 8d67e42ad3b1a95a152541015a07110e06992d6c affected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< 08a3e218064db11f154ad9ad5541751ea7f34ebe affected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< fb0521aff1e10e300d89725cc439d3ea74c828c5 affected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< f7f2fbb0e893a0238dc464f8d8c0f5609bec584f affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53219

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: x_tables: avoid leaking percpu counter pointers
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: avoid leaking percpu counter pointers The native and compat get-entries paths copy the fixed rule entry header from the kernelized rule blob to userspace before overwriting the entry's counter fields with a sanitized counter snapshot. On SMP kernels, entry->counters.pcnt contains the percpu allocation address used by x_tables rule counters. A caller can provide a userspace buffer that faults during the initial fixed-header copy after pcnt has been copied but before the later sanitized counter copy runs. The syscall then returns -EFAULT while leaving the raw percpu pointer in userspace. Copy only the fixed entry prefix before counters from the kernelized rule blob, then copy the sanitized counter snapshot into the counter field. Apply this ordering to the IPv4, IPv6, and ARP native and compat get-entries implementations so a fault cannot expose the internal percpu counter pointer.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于x_tables中泄漏percpu计数器指针，可能导致内部percpu计数器指针暴露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 71ae0dff02d756e4d2ca710b79f2ff5390029a5f ~ b74ba3343eb44b2cbf7e9665918c287df1d52ebb -
Linux Linux 4.2 -

II. Public POCs for CVE-2026-53219

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53219

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53219 (8)

Same Patch Batch · Linux · 2026-06-25 · 146 CVEs total

CVE-2026-53176 9.8 CRITICAL IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
CVE-2026-53228 9.8 CRITICAL ipv6: sit: reload inner IPv6 header after GSO offloads
CVE-2026-53151 9.8 CRITICAL rxrpc: Fix the ACK parser to extract the SACK table for parsing
CVE-2026-53221 9.8 CRITICAL ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
CVE-2026-53247 9.8 CRITICAL net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
CVE-2026-53216 9.8 CRITICAL net: mvpp2: limit XDP frame size to the RX buffer
CVE-2026-53260 9.8 CRITICAL tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
CVE-2026-53246 9.8 CRITICAL sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
CVE-2026-53175 9.8 CRITICAL inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
CVE-2026-53215 9.8 CRITICAL net: mvpp2: refill RX buffers before XDP or skb use
CVE-2026-53131 9.4 CRITICAL netfilter: require Ethernet MAC header before using eth_hdr()
CVE-2026-53225 9.1 CRITICAL sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
CVE-2026-53224 9.1 CRITICAL sctp: validate embedded INIT chunk and address list lengths in cookie
CVE-2026-53186 9.1 CRITICAL RDMA/srp: bound SRP_RSP sense copy by the received length
CVE-2026-53240 8.8 HIGH xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
CVE-2026-53171 8.8 HIGH accel/ethosu: fix arithmetic issues in dma_length()
CVE-2026-53232 8.8 HIGH net: phy: clean the sfp upstream if phy probing fails
CVE-2026-53159 8.8 HIGH misc: fastrpc: fix DMA address corruption due to find_vma misuse
CVE-2026-53170 8.8 HIGH accel/ethosu: reject DMA commands with uninitialized length
CVE-2026-53188 8.8 HIGH RDMA/core: Validate the passed in fops for ib_get_ucaps()

Showing top 20 of 146 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53219

No comments yet

Leave a comment