CVE-2026-64576

A flaw was found in the Linux kernel's nexthop subsystem that leads to a local denial of service with moderate impact. When a local user with network administration privileges (CAP_NET_ADMIN) performs a resilient nexthop bucket migration through the rtnetlink interface, nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack structure to the nexthop notifier call chain. If the notifier information initialization then fails, for example when a memory allocation returns -ENOMEM, the error path formats the uninitialized extack._msg pointer as a string in a rate-limited kernel log message, dereferencing uninitialized stack memory. This can cause a general protection fault and a kernel panic, resulting in a denial of service of the affected system.

Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in their kernels. Red Hat Enterprise Linux 9 (kernel and kernel-rt), Red Hat Enterprise Linux 10 (kernel), and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected. The fix for these products is currently deferred to a future update: the flaw has low practical exploitability because it requires local privileged access to the rtnetlink control plane, and triggering it additionally requires a memory allocation failure on a specific error path, which an attacker cannot reliably induce. The residual risk is that a local privileged user who manages to trigger the faulty error path could panic the system and cause a denial of service.

Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record assigns a higher score of 7.1 by including a high confidentiality impact. The available technical evidence shows only a denial-of-service primitive, an uninitialized pointer read formatted for a kernel log message, with no demonstrated information disclosure, so Red Hat assesses the confidentiality impact as none.