In the Linux kernel’s netfilter framework, the nft_exthdr component incorrectly tracks the initialization status of registers. When the F_PRESENT flag is set, nft_exthdr_init passes a user supplied length to nft_parse_register_store, marking that many registers as initialized. The subsequent evaluation path only writes one or a few bytes, but the registered bitmap remains marked as initialized beyond that point. Consequently, registers beyond the first are never written, leaving uninitialized stack data in nft_regs, which can be read by attackers and can expose sensitive information within the kernel.

All Linux kernel builds that include the nft_exthdr extension without the patch are affected. The specific version range is not enumerated, but any kernel release containing the unpatched nft_exthdr code is vulnerable.

Because the flaw deals with uninitialized registers, an attacker could potentially extract kernel memory contents or influence further kernel behavior. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation has been observed. The CVSS score is unspecified in the advisory, but the nature of the bug indicates a moderate to high severity for kernel‑privileged attackers.