The Linux kernel netfilter x_tables subsystem had a vulnerability where the native and compat get-entries paths copied the fixed rule entry header from the kernelized rule blob to userspace before overwriting the entry's counter fields with a sanitized snapshot. On SMP kernels, the entry->counters.pcnt field contains a percpu allocation address. If a userspace buffer faults during the initial copy after pcnt is copied but before the sanitized counter copy, the syscall returns -EFAULT but leaves the raw percpu pointer exposed in userspace. The fix changes the copy order to first copy only the fixed entry prefix before counters, then copy the sanitized counter snapshot, preventing exposure of the internal percpu pointer. This fix applies to IPv4, IPv6, and ARP native and compat get-entries implementations.

The vulnerability does not impact confidentiality, integrity, or availability directly but can leak internal kernel percpu counter pointers to userspace under fault conditions. This pointer leak could potentially aid an attacker in kernel address space information disclosure or further exploitation, but no direct code execution or data corruption is indicated. The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact due to syscall failure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel security advisories for patches addressing CVE-2026-53219. Until patched, avoid running untrusted code that can trigger netfilter get-entries syscalls or cause userspace buffer faults during these operations.