Skip to main content

Linux Kernel EUVDEUVD-2026-38882

| CVE-2026-53014 MEDIUM
2026-06-24 Linux GHSA-x2v8-3q4q-r8g6
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.1 MEDIUM

Mixed-device TC block is non-default (AC:H); CAP_NET_ADMIN required for TC rule configuration (PR:H); no confidentiality or integrity impact confirmed.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 15, 2026 - 16:16 vuln.today
CVSS changed
Jul 15, 2026 - 14:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

In tcf_blockcast_redir(), when iterating block ports to redirect packets to multiple devices, the mac_header_xmit flag is queried from the wrong device. The loop sends to dev_prev but queries dev_is_mac_header_xmit(dev) - which is the NEXT device in the iteration, not the one being sent to.

This causes tcf_mirred_to_dev() to make incorrect decisions about whether to push or pull the MAC header. When the block contains mixed device types (e.g., an ethernet veth and a tunnel device), intermediate devices get the wrong mac_header_xmit flag, leading to skb header corruption. In the worst case, skb_push_rcsum with an incorrect mac_len can exhaust headroom and panic.

The last device in the loop is handled correctly (line 365-366 uses dev_is_mac_header_xmit(dev_prev)), confirming this is a copy-paste oversight for the intermediate devices.

Fix by using dev_prev instead of dev for the mac_header_xmit query, consistent with the device actually being sent to.

AnalysisAI

Kernel panic via skb headroom exhaustion in the Linux kernel's Traffic Control (TC) act_mirred subsystem affects systems using block-cast packet redirection across mixed device types. The root cause is a copy-paste error in tcf_blockcast_redir() where dev_is_mac_header_xmit() is queried against the next device in the iteration (dev) rather than the device currently being transmitted to (dev_prev), causing tcf_mirred_to_dev() to make wrong MAC header push/pull decisions for intermediate devices. In the worst case, skb_push_rcsum is called with an incorrect mac_len, exhausting socket buffer headroom and triggering a kernel panic. No public exploit code has been identified and EPSS is 0.17% at the 6th percentile, consistent with low real-world exploitation interest.

Technical ContextAI

The vulnerability resides in net/sched/act_mirred.c within the Linux kernel's Traffic Control subsystem, introduced at commit 42f39036cda808d3de243192a2cf5125f12f3047. The mirred action supports block-cast redirection, which iterates over all ports in a TC block to mirror or redirect packets to multiple egress devices simultaneously. The helper dev_is_mac_header_xmit() determines whether a target device operates at Layer 2 (expects a MAC header) or is a tunnel/L3 device (does not), and tcf_mirred_to_dev() uses this flag to decide whether to push or pull the skb MAC header before transmission. The bug is a classic loop-variable mismatch: all intermediate devices in the loop are evaluated with the flag from dev (the next device to be processed) rather than dev_prev (the device currently being sent to). Only the final iteration is handled correctly at lines 365-366. No CWE is formally assigned, but the root cause corresponds most closely to CWE-193 (Off-by-One Error) applied to a loop variable selection. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from the introductory commit through the patched stable releases.

RemediationAI

Upgrade to a patched stable kernel release: 6.12.91, 6.18.33, 7.0.10, or 7.1, as confirmed by upstream stable commits at git.kernel.org (see affected_products for direct links). Distribution vendors (RHEL, Debian, Ubuntu, SUSE) are expected to backport these fixes into their respective errata; check vendor security channels for package-level advisories. For systems that cannot be patched immediately, the specific risk can be substantially mitigated by auditing and restricting TC block configurations to homogeneous device types - avoiding blocks that mix MAC-header-transmitting interfaces (Ethernet, veth) with tunnel or L3 interfaces (GRE, VXLAN, ipip); this prevents the mismatched flag from causing corruption. Additionally, restricting CAP_NET_ADMIN to trusted administrative processes via seccomp profiles, AppArmor/SELinux policy, or user-namespace scoping limits who can configure the vulnerable code path, though this may break legitimate network management tooling and container networking stacks that depend on that capability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38882 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy