PT-2026-51908 · Linux · Linux

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-53014

Mitre

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act mirred: fix wrong device for mac header xmit check in tcf blockcast redir

In tcf blockcast redir(), when iterating block ports to redirect packets to multiple devices, the mac header xmit flag is queried from the wrong device. The loop sends to dev prev but queries dev is mac header xmit(dev) — which is the NEXT device in the iteration, not the one being sent to.

This causes tcf mirred to dev() to make incorrect decisions about whether to push or pull the MAC header. When the block contains mixed device types (e.g., an ethernet veth and a tunnel device), intermediate devices get the wrong mac header xmit flag, leading to skb header corruption. In the worst case, skb push rcsum with an incorrect mac len can exhaust headroom and panic.

The last device in the loop is handled correctly (line 365-366 uses dev is mac header xmit(dev prev)), confirming this is a copy-paste oversight for the intermediate devices.

Fix by using dev prev instead of dev for the mac header xmit query, consistent with the device actually being sent to.

Identificadores relacionados

CVE-2026-53014

Produtos afetados

Linux

Referências · 5

• https://git.kernel.org/stable/c/4764953c4b47585eb72797b216b63a831dc0c7e6 · Nota
• https://git.kernel.org/stable/c/8fda5174286119addd28473fb2ec5bdf521c05a8 · Nota
• https://git.kernel.org/stable/c/4510d140524ca7d6e772db962e013f26f09a63b1 · Nota
• https://git.kernel.org/stable/c/7db3e4e03032261b1b519341123fc30d995478ca · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53014 · Nota de Segurança