Skip to main content

Linux Kernel CVE-2026-53238

| EUVDEUVD-2026-39329 MEDIUM
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-5qwx-4q7j-hwm2
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local Netlink interface requires low privilege; availability-only impact confirmed by description; no confidentiality or integrity impact substantiated by vendor scoring.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
2.3 LOW
AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 13:30 vuln.today
CVSS changed
Jul 08, 2026 - 13:22 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netlabel: validate unlabeled address and mask attribute lengths

netlbl_unlabel_addrinfo_get() used the address attribute length to determine whether the attribute data could be read as an IPv4 or IPv6 address, but did not independently validate the corresponding mask attribute length. A crafted Generic Netlink request could therefore provide a valid IPv4/IPv6 address attribute with a shorter mask attribute, which would later be read as a full struct in_addr or struct in6_addr.

NLA_BINARY policy lengths are maximum lengths by default, so use NLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask attributes. This rejects short attributes during policy validation and also exposes the exact length requirements through policy introspection.

AnalysisAI

Out-of-bounds read in the Linux kernel netlabel subsystem allows a local low-privileged attacker to crash the kernel by submitting a crafted Generic Netlink request with a valid IPv4/IPv6 address attribute paired with a shorter-than-expected mask attribute. The netlbl_unlabel_addrinfo_get() function relied solely on the address attribute length to determine address family, then unconditionally read the mask attribute as a full struct in_addr (4 bytes) or struct in6_addr (16 bytes) without independently validating the mask length. No public exploit or active exploitation has been identified (EPSS 0.18%, 8th percentile); patches are available across all maintained stable branches.

Technical ContextAI

The Linux kernel netlabel subsystem (net/netlabel/) provides MAC-based network packet labeling, configurable via Generic Netlink (GENL). The vulnerable path is in netlbl_unlabel_addrinfo_get(), which parses NLA_BINARY Netlink attributes for unlabeled IPv4/IPv6 address and mask values. NLA_BINARY attributes enforce only a maximum length by default, meaning userspace can supply attributes shorter than the target struct size. The code used the address attribute's length to infer IPv4 vs. IPv6 but cast the mask attribute directly to struct in_addr (4 bytes) or struct in6_addr (16 bytes) regardless of the mask attribute's actual length. The fix adopts NLA_POLICY_EXACT_LEN() for both address and mask attributes, rejecting under-length attributes at policy validation time - before any data is read. Affected CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. The CWE was not formally assigned, but the root cause class is improper input validation / insufficient length check (analogous to CWE-1284 or CWE-125).

RemediationAI

Upgrade to a patched kernel version: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 as appropriate for the deployed branch. Stable patch commits are published at https://git.kernel.org/stable/c/07a18f5c90dd3d586b73242f5a5bbf0a72f2fdc6 and related commits for each branch. Distribution vendors (Red Hat, Ubuntu, SUSE, Debian) are expected to backport these fixes to their kernel packages. As a compensating control prior to patching, restricting CAP_NET_ADMIN capability - particularly preventing unprivileged user namespace creation via 'sysctl kernel.unprivileged_userns_clone=0' or equivalent - limits the attack surface to root-equivalent users, substantially reducing risk. Note that disabling unprivileged user namespaces may break container runtimes (e.g., rootless Podman, certain Docker configurations) and should be evaluated against operational requirements. There is no known application-layer workaround; kernel patching is the definitive fix.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53238 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy