Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem (netfilter) where certain firewall matching rules were incorrectly allowed to operate on unsupported network protocols. This could lead to unexpected system behavior or memory safety issues when processing network traffic. The issue has been resolved by restricting these specific firewall components to only work with standard IPv4 and IPv6 traffic.
Technical details
A vulnerability in the Linux kernel netfilter xtables subsystem was caused by an over-broad application of NFPROTO_UNSPEC in several extensions. Specifically, xt_mac, xt_owner, and xt_physdev were incorrectly allowed to match protocols beyond IPv4 and IPv6, while xt_realm (which relies on IPv4-specific dst->tclassid) was not restricted to the inet family. This could allow an attacker to trigger unexpected code paths or memory access patterns by sending traffic through protocols not intended for these extensions. The fix involves a partial revert of commit ab4f21e6fb1c to explicitly restrict these matches to NFPROTO_IPV4 and NFPROTO_IPV6. Patches have been released across multiple stable kernel branches including 5.10.y and 5.15.y.
Affected products
- Linux Linux Kernel 2.6.28 to 5.10.258, 5.15.209, and other stable branches
Timeline
- 2026-04-15: other: Initial fix authored by Pablo Neira Ayuso
- 2026-06-24: disclosed: CVE-2026-53001 published
References
- https://git.kernel.org/stable/c/14203f9edf944b3fb63faadd62f38452421ecdfc
- https://git.kernel.org/stable/c/689a91ff18d6448d94c1ab7c076fecdb2b668bef
- https://git.kernel.org/stable/c/76160e04440c9698b989dbd9492a7ec4f520c9ee
- https://git.kernel.org/stable/c/7eaf9c740f33230cb224dc265f3c69f8531ff57b
- https://git.kernel.org/stable/c/9a109751b297b0f2135495749ef5a18ba31ec7d4
- https://git.kernel.org/stable/c/b6fe26f86a1649f84e057f3f15605b08eda15497
- https://git.kernel.org/stable/c/cbeb259f31382de70a70a59ffd0e66f5e80d9818