Linux Kernel CVE-2026-53001

The Linux kernel's netfilter framework provides packet filtering via the xtables extension system, used by iptables, ip6tables, ebtables, and arptables. Commit ab4f21e6fb1c changed xt_mac, xt_owner, xt_physdev, and xt_realm to register under NFPROTO_UNSPEC, allowing instantiation in any netfilter protocol family including ebtables (Ethernet bridge filtering). However, xt_realm depends on the IPv4-specific field dst->tclassid, and the other extensions carry implicit packet-structure assumptions valid only in inet (IPv4/IPv6) contexts. Accessing these fields in an ebtables context - where packets are Layer 2 Ethernet frames - can trigger null pointer dereferences or out-of-bounds reads, leading to kernel panic. This CVE is a partial revert that restricts these extensions back to NFPROTO_INET. No CWE identifier is provided in the source data; the root cause class is closest to CWE-119 (Improper Restriction of Operations within Bounds) or CWE-476 (NULL Pointer Dereference). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, spanning stable branches from the introduction of ab4f21e6fb1c through the respective fix commits.