The vulnerability in the Linux kernel's netfilter nft_fib module involves a stale stack leak via the OIFNAME register. Specifically, for NFT_FIB_RESULT_OIFNAME, the destination register is declared with a length of IFNAMSIZ (four 32-bit registers), but on lookup failure paths, only one register is cleared, leaving the remaining three registers uninitialized. This stale data can be leaked to userspace by downstream expressions that load the register span. Additionally, the NFTA_FIB_F_PRESENT flag was accepted for any result type but only writes one byte, leaving the rest of the declared span stale. The fix replaces the partial clearing with a function that zeroes the entire register span and restricts the NFTA_FIB_F_PRESENT flag to the appropriate result type with a matching destination size.

The vulnerability allows leakage of uninitialized kernel stack memory to userspace, which could potentially expose sensitive kernel data. The CVSS score is 5.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and no confidentiality or integrity impact but high availability impact. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the vulnerability has been resolved in the Linux kernel by replacing partial zeroing with a full zeroing function and restricting flag usage. Users should apply official Linux kernel updates once available to remediate this issue.