Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53219— netfilter: x_tables: avoid leaking percpu counter pointers

AI Predicted 5.5 Difficulty: Hard EPSS 0.12% · P2

Possible ATT&CK Techniques 1AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 18

VendorProductVersion RangeStatus
LinuxLinux71ae0dff02d756e4d2ca710b79f2ff5390029a5f< b74ba3343eb44b2cbf7e9665918c287df1d52ebbaffected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< 0b35dc8527ccc16b7dc34e8a3164313e68cd4e45affected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< b28e2fcad3db7e8687b15bc20bced26b5b7c920eaffected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< a0d16941adf3a501956d74aefd8d6e217906e79caffected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< 8d67e42ad3b1a95a152541015a07110e06992d6caffected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< 08a3e218064db11f154ad9ad5541751ea7f34ebeaffected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< fb0521aff1e10e300d89725cc439d3ea74c828c5affected
71ae0dff02d756e4d2ca710b79f2ff5390029a5f< f7f2fbb0e893a0238dc464f8d8c0f5609bec584faffected
… +10 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-53219

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: x_tables: avoid leaking percpu counter pointers
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: avoid leaking percpu counter pointers The native and compat get-entries paths copy the fixed rule entry header from the kernelized rule blob to userspace before overwriting the entry's counter fields with a sanitized counter snapshot. On SMP kernels, entry->counters.pcnt contains the percpu allocation address used by x_tables rule counters. A caller can provide a userspace buffer that faults during the initial fixed-header copy after pcnt has been copied but before the later sanitized counter copy runs. The syscall then returns -EFAULT while leaving the raw percpu pointer in userspace. Copy only the fixed entry prefix before counters from the kernelized rule blob, then copy the sanitized counter snapshot into the counter field. Apply this ordering to the IPv4, IPv6, and ARP native and compat get-entries implementations so a fault cannot expose the internal percpu counter pointer.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于x_tables中泄漏percpu计数器指针，可能导致内部percpu计数器指针暴露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 71ae0dff02d756e4d2ca710b79f2ff5390029a5f ~ b74ba3343eb44b2cbf7e9665918c287df1d52ebb -
LinuxLinux 4.2 -

II. Public POCs for CVE-2026-53219

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53219

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53219 (8)

Same Patch Batch · Linux · 2026-06-25 · 146 CVEs total

CVE-2026-531769.8 CRITICALIB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
CVE-2026-532289.8 CRITICALipv6: sit: reload inner IPv6 header after GSO offloads
CVE-2026-531519.8 CRITICALrxrpc: Fix the ACK parser to extract the SACK table for parsing
CVE-2026-532219.8 CRITICALip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
CVE-2026-532479.8 CRITICALnet: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
CVE-2026-532169.8 CRITICALnet: mvpp2: limit XDP frame size to the RX buffer
CVE-2026-532609.8 CRITICALtcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
CVE-2026-532469.8 CRITICALsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
CVE-2026-531759.8 CRITICALinet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
CVE-2026-532159.8 CRITICALnet: mvpp2: refill RX buffers before XDP or skb use
CVE-2026-531319.4 CRITICALnetfilter: require Ethernet MAC header before using eth_hdr()
CVE-2026-532259.1 CRITICALsctp: fix uninit-value in __sctp_rcv_asconf_lookup()
CVE-2026-532249.1 CRITICALsctp: validate embedded INIT chunk and address list lengths in cookie
CVE-2026-531869.1 CRITICALRDMA/srp: bound SRP_RSP sense copy by the received length
CVE-2026-532408.8 HIGHxfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
CVE-2026-531718.8 HIGHaccel/ethosu: fix arithmetic issues in dma_length()
CVE-2026-532328.8 HIGHnet: phy: clean the sfp upstream if phy probing fails
CVE-2026-531598.8 HIGHmisc: fastrpc: fix DMA address corruption due to find_vma misuse
CVE-2026-531708.8 HIGHaccel/ethosu: reject DMA commands with uninitialized length
CVE-2026-531888.8 HIGHRDMA/core: Validate the passed in fops for ib_get_ucaps()

Showing top 20 of 146 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53219

No comments yet

Leave a comment