Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow for system instability or crashes when processing certain network packets. The issue occurs in the Netfilter component, which handles firewalling and packet filtering, when it incorrectly assumes a packet has a standard Ethernet header. This could potentially be exploited to disrupt network services or cause a denial-of-service condition.
Technical details
Multiple components within Netfilter, including ip6t_eui64, xt_mac, and various ipset types (bitmap:ip,mac, hash:ip,mac, hash:mac), as well as nf_log_syslog, were found to access the Ethernet header (eth_hdr) without sufficient validation. The code previously assumed the socket buffer (skb) was associated with an Ethernet device or only performed minimal bounds checking. An attacker could potentially trigger an out-of-bounds read or crash by sending packets that lack a proper Ethernet MAC header or are associated with non-Ethernet interfaces. The fix introduces explicit checks to verify the device type is ARPHRD_ETHER and that the MAC header is correctly set and of sufficient length (ETH_HLEN) before access.
Affected products
- Linux Linux Kernel < 5.15.210, < 6.1.176, < 6.6.143, < 6.12.94, < 6.18.36, < 7.0.13
Timeline
- 2026-06-25: advisory: CVE-2026-53131 published by NVD
- 2026-06-19: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/063f43361e884acd7300790e90194430275d0d0c
- https://git.kernel.org/stable/c/367abcacc13a8e2e7624408b7f593bd1e60e49d9
- https://git.kernel.org/stable/c/4435888e1bf139d2bfe5911643d4217382136743
- https://git.kernel.org/stable/c/5d634afb8b83b49de562792fd0d047416a43bd4d
- https://git.kernel.org/stable/c/62443dc21114c0bbc476fa62973db89743f2f137
- https://git.kernel.org/stable/c/726abf97566867f808fec9d8a408eb9698bd570a
- https://git.kernel.org/stable/c/cea435ea7e868ea6fdf039bc4f2090c1d829b556