Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem that could allow a local user to trigger an out-of-bounds memory read. This occurs when the system attempts to log network packets that are missing specific header information, potentially causing the system to read data beyond the intended memory buffer. While primarily impacting system stability, such flaws can sometimes be used to leak sensitive kernel information into system logs.
Technical details
An out-of-bounds read vulnerability exists in the netfilter nf_log component of the Linux kernel. The function dump_mac_header() in net/netfilter/nf_log_syslog.c fails to verify if a MAC header was actually set using skb_mac_header_was_set() before accessing it. When an unset MAC header (indicated by 0xffff) is processed, the kernel calculates an offset approximately 64 KiB past the buffer head, leading to a slab-out-of-bounds read. This path is reachable via the netdev logger when packets are sent through AF_PACKET with PACKET_QDISC_BYPASS, which skips the standard header initialization. The fix involves adding explicit checks for skb_mac_header_was_set() and using skb_mac_header_len() to ensure valid memory access.
Affected products
- Linux Linux Kernel 7eb9282cd0ef to d704ee9c7bc68a161684c51a7ac05b446dcf38d4
Timeline
- 2026-06-09: other: Vulnerability fixed in upstream commits
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/65ef7397eb9a296e91839f5fd10be96f23d332e7
- https://git.kernel.org/stable/c/8a81e336da685423f5b64aac4d571e63d674c52a
- https://git.kernel.org/stable/c/a84b6fedbc97078788be78dbdd7517d143ad1a77
- https://git.kernel.org/stable/c/af1b7699466f6556b351fa25d3dc870abfb5d310
- https://git.kernel.org/stable/c/befb8968a2abdfa948d5600ea7f7a509a292a590
- https://git.kernel.org/stable/c/c38d41134085193efd5b237cf513ad5b3421a60d
- https://git.kernel.org/stable/c/d704ee9c7bc68a161684c51a7ac05b446dcf38d4