Executive brief
A vulnerability in the Linux kernel's macvlan driver can cause system warnings and prevent network interface information from being displayed. This occurs when the system fails to reserve enough memory for specific network configuration data, leading to an error when a user attempts to view network settings. While it does not directly expose data, it can interfere with network management and monitoring tools.
Technical details
A bug in the macvlan_get_size() function in the Linux kernel fails to account for the IFLA_MACVLAN_BC_CUTOFF attribute when calculating the required Netlink message size. When a macvlan interface is configured with a broadcast cutoff (bc_cutoff) value other than 1, macvlan_fill_info() attempts to add the attribute to the Netlink skb. If the buffer is full, nla_put_s32() returns -EMSGSIZE, triggering a WARN_ON in the rtnetlink subsystem and causing commands like 'ip link show' to fail. This is a local denial-of-service or information-gathering failure reachable via standard network configuration tools. The issue has been patched in various stable branches including 6.6.y, 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.4 to 7.0.10
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/1c004f14ccdc11585625c168bb9a7c5e1b8afb0c
- https://git.kernel.org/stable/c/4979252758387b338ca968ba7e0515b0ae2257e3
- https://git.kernel.org/stable/c/77ecfa4e27f282d224215895ddfbeb916fc75e24
- https://git.kernel.org/stable/c/b6b7154e9f5d75b608ceb2d05b376de8c638c40e
- https://git.kernel.org/stable/c/fa92a77b0ed4d5f11a71665a232ac5a54a4b055d