A flaw in the Linux kernel netfilter nft_meta_bridge subsystem causes a stale stack leak via the IIFHWADDR register. The destination register is declared to hold 6 bytes but the kernel rounds it to 8 bytes. A memcpy then copies only 6 bytes from the bridge device address, leaving the upper two bytes of the register uninitialized on the stack. Those stale bytes are later loaded by nft_do_chain() and can be read by userspace, leaking sensitive data from kernel memory.

All Linux kernel releases before incorporation of commit 07acb979 and its associated patches. The vulnerability applies to any variant of the Linux kernel that includes the nft_meta_bridge module for bridge interfaces.

The vulnerability is an information‑disclosure flaw that requires the attacker to execute nftables commands against the target kernel. It is therefore a local or privileged attack vector; remote exploitation is unlikely unless privilege escalation is achieved first. The absence of a public CVSS score or EPSS metric leaves the exact severity indeterminate, but the potential to read arbitrary kernel memory makes it a high‑risk issue. The vulnerability is not currently listed in CISA’s KEV catalog.