CVE-2026-52942: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-52942 Overview

CVE-2026-52942 is an out-of-bounds read vulnerability in the Linux kernel netfilter subsystem. The flaw resides in the dump_mac_header() function within net/netfilter/nf_log_syslog.c. The fallback path checks skb->mac_header != skb->network_header but omits the skb_mac_header_was_set() validation. When the MAC header is unset, mac_header defaults to 0xffff, causing skb_mac_header(skb) to return a pointer roughly 64 KiB past the socket buffer. The kernel then reads dev->hard_header_len bytes out of bounds and writes them into the kernel log, leaking adjacent slab memory.

Critical Impact
A local unprivileged process can use AF_PACKET sockets with PACKET_QDISC_BYPASS to trigger an out-of-bounds slab read through the netdev logger, exposing kernel memory contents to dmesg.

Affected Products

Linux kernel netfilter subsystem (nf_log_syslog)
Distributions shipping vulnerable kernels with netdev logging enabled
Systems using nft_log with netdev chains

Discovery Timeline

2026-06-24 - CVE-2026-52942 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52942

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the netfilter logging subsystem. The fallback branch of dump_mac_header() evaluates skb->mac_header != skb->network_header to decide whether to dump the link-layer header. This check does not detect the sentinel value used when the MAC header has not been set. The skb_mac_header_was_set() helper exists for that purpose and is already used on the ARPHRD_ETHER path. The loop then dereferences skb_mac_header(skb) and reads dev->hard_header_len bytes into the syslog buffer.

KASAN confirms the bug with a slab-out-of-bounds read reported in dump_mac_header at net/netfilter/nf_log_syslog.c:831. The leaked bytes land in the kernel ring buffer, where they can be retrieved by any process with access to dmesg output.

Root Cause

The root cause is missing input validation on socket buffer metadata. When an skb has no MAC header, skb->mac_header holds the sentinel value 0xffff. The fallback path treats this as a valid offset because it differs from network_header. The function computes skb->head + 0xffff and dereferences memory well past the allocated slab object. Only skbs with an unset MAC header are affected; properly initialized packets are dumped as before.

Attack Vector

The issue is reachable through the netdev logger. nf_log_unknown_packet() calls dump_mac_header() without checking whether the MAC header was set. A local attacker opens an AF_PACKET socket, enables PACKET_QDISC_BYPASS, and transmits a packet. The egress hook fires before __dev_queue_xmit() resets the MAC header, so the skb reaches nf_hook_direct_egress() with mac_header unset. If an nft_log rule is attached to a netdev chain, the logger triggers the out-of-bounds read. The vulnerability requires local access and a netfilter ruleset that invokes the logger on egress.

The vulnerability manifests in dump_mac_header(). See the upstream commits linked in Kernel Git Commit Summary 1 and Kernel Git Commit Summary 7 for the exact source changes.

Detection Methods for CVE-2026-52942

Indicators of Compromise

KASAN reports referencing dump_mac_header or nf_log_netdev_packet in kernel logs
Unexplained kernel log entries containing binary MAC header dumps from egress hooks
Processes opening AF_PACKET sockets and setting PACKET_QDISC_BYPASS on systems with nft_log netdev rules

Detection Strategies

Audit nftables rulesets for log statements attached to netdev chains using nft list ruleset
Enable KASAN on test kernels to surface slab-out-of-bounds reads triggered by malformed skbs
Monitor auditd for socket() calls with AF_PACKET followed by setsockopt operations setting PACKET_QDISC_BYPASS

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a central logging platform and alert on KASAN signatures
Track kernel version inventory across the fleet and flag hosts running unpatched stable branches
Correlate unprivileged process activity with creation of raw packet sockets on production servers

How to Mitigate CVE-2026-52942

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits listed in this advisory
Update to a kernel build that adds the skb_mac_header_was_set() check and uses skb_mac_header_len() in dump_mac_header()
Remove or disable log actions on netdev nftables chains until patched kernels are deployed

Patch Information

The fix adds the skb_mac_header_was_set() check that the ARPHRD_ETHER path already uses and replaces the open-coded MAC header length test with skb_mac_header_len(). Patches are merged across multiple stable branches. See Kernel Git Commit 65ef7397, Kernel Git Commit 8a81e336, Kernel Git Commit a84b6fed, Kernel Git Commit af1b7699, Kernel Git Commit befb8968, Kernel Git Commit c38d4113, and Kernel Git Commit d704ee9c.

Workarounds

Remove log statements from nftables netdev chains until the kernel patch is applied
Restrict CAP_NET_RAW to trusted users to limit who can open AF_PACKET sockets
Tighten dmesg access by setting kernel.dmesg_restrict=1 via sysctl to limit information leak exposure

bash

# Restrict dmesg access to root only
sysctl -w kernel.dmesg_restrict=1
echo 'kernel.dmesg_restrict=1' >> /etc/sysctl.d/99-hardening.conf

# List netdev chains that invoke the logger
nft list ruleset | grep -E 'type filter hook (ingress|egress)|log'