Junglewise Threat Intelligence

CVE-2026-53245: Linux Kernel MRP vector attribute parsing logic error in mrp_pdu_parse_vecattr

CVE-2026-53245 · Severity: info · CVSS 0 · Published 2026-06-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's implementation of the Multiple Registration Protocol (MRP), which is used for managing group memberships in network switches. An attacker could potentially send specially crafted network packets to cause the system to misinterpret network data, leading to incorrect protocol states or memory offset corruption. This could impact the stability and reliability of network communications on affected systems.

Technical details

A logic error exists in the 'mrp_pdu_parse_vecattr' function within 'net/802/mrp.c' of the Linux kernel. The parser fails to correctly decrement the event counter (valen) when processing the third event in a byte, leading to out-of-bounds reads of subsequent bytes when valen is a multiple of three. Additionally, the parser incorrectly handles cases where valen is zero by attempting to consume 'FirstValue' bytes that are not present per IEEE 802.1ak, and fails to increment attribute values when crossing byte boundaries. These flaws result in PDU offset corruption and the application of spurious events to the MRP applicant state. Patches have been released across multiple stable kernel branches to ensure proper counter decrementing and attribute value incrementing.

Affected products

  • Linux Linux Kernel versions before 6.10, 6.6.34, 6.1.94, 5.15.161, 5.10.219, 5.4.278, 4.19.316

Timeline

  • 2026-06-03: disclosed: Initial patch submitted by Yizhou Zhao
  • 2026-06-19: patched: Commits merged into stable branches by Greg Kroah-Hartman
  • 2026-06-25: advisory: CVE-2026-53245 published

References

Related threats