A flaw in the Linux kernel netfilter nft_meta_bridge subsystem causes a stale stack leak via the IIFHWADDR register. The destination register is declared to hold 6 bytes but the kernel rounds it to 8 bytes. A memcpy then copies only 6 bytes from the bridge device address, leaving the upper two bytes of the register uninitialized on the stack. Those stale bytes are later loaded by nft_do_chain() and can be read by userspace, leaking sensitive data from kernel memory. This represents a combination of CWE-131 (Incorrect Size/Allocation) and CWE-401 (Uninitialized Variable) vulnerabilities.

The vulnerability exists in all Linux kernel versions that include the nft_meta_bridge subsystem and lack the commit that zeroes the register before memcpy. That includes any kernel before commit 07acb979, as shown in the provided CPEs, covering all mainstream releases up to the current stable series. Distributions shipping such kernels without the patch are affected.

The CVSS score of 5.5 signals moderate severity. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA KEV, reducing its prevalence. Exploitation requires local or privileged execution of nftables commands that reference the IIFHWADDR register, which is inferred from the description; therefore remote exploitation would need further privilege escalation. Given these constraints, the risk remains moderate but should be mitigated promptly.