Linux Kernel EUVD-2026-38881

The vulnerability is rooted in a netlink message buffer sizing mismatch within the Linux kernel macvlan driver. macvlan_get_size() pre-calculates the required skb buffer size for a GETLINK response; macvlan_fill_info() then serializes the attributes into that buffer. The IFLA_MACVLAN_BC_CUTOFF attribute (a signed 32-bit integer, requiring nla_total_size(4) = 8 bytes of reservation) was introduced in commit 954d1fa1ac93 ('macvlan: Add netlink attribute for broadcast cutoff'), which added the nla_put_s32() call to macvlan_fill_info() but omitted the corresponding size reservation in macvlan_get_size(). A subsequent fix, commit 55cef78c244d ('macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF'), addressed a missing policy table entry but left the size calculation uncorrected. The result is that when bc_cutoff differs from its default (1), macvlan_fill_info() attempts to write beyond the pre-allocated buffer, causing the -EMSGSIZE failure. No CWE is formally assigned, but this is a classic off-by-one netlink buffer sizing omission. Affected CPE: cpe:2.3:a:linux:linux:* covering versions from the introduction of commit 954d1fa1ac93 (Linux 6.4 era) through the fixed stable releases.