CVE-2026-53013: Linux Kernel Macvlan DOS Vulnerability

CVE-2026-53013 Overview

CVE-2026-53013 is a Linux kernel vulnerability in the macvlan driver. The function macvlan_get_size() fails to reserve netlink attribute space for IFLA_MACVLAN_BC_CUTOFF, while macvlan_fill_info() conditionally emits that attribute when port->bc_cutoff != 1. The mismatch causes nla_put_s32() to return -EMSGSIZE when the netlink socket buffer (skb) runs out of space. This triggers a WARN_ON in rtnetlink and prevents the interface from being dumped via ip link show.

Critical Impact
Local users with the ability to configure macvlan interfaces can trigger kernel warnings and break netlink interface enumeration, disrupting network management tooling.

Affected Products

Linux kernel versions containing commit 954d1fa1ac93 (macvlan broadcast cutoff feature) prior to the fix
Distributions shipping affected stable kernel branches
Systems using the macvlan driver with non-default bc_cutoff values

Discovery Timeline

2026-06-24 - CVE-2026-53013 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53013

Vulnerability Analysis

The macvlan driver implements netlink serialization using two complementary callbacks. The macvlan_get_size() function returns the total byte count required to serialize all attributes for a given interface. The macvlan_fill_info() function writes those attributes into the preallocated netlink skb.

When the broadcast cutoff feature was introduced, the nla_put_s32() call for IFLA_MACVLAN_BC_CUTOFF was added to macvlan_fill_info() without a corresponding nla_total_size(4) entry in macvlan_get_size(). Any operator who sets bc_cutoff to a value other than 1 causes the fill routine to attempt writing more bytes than were reserved. The result is an -EMSGSIZE failure, a kernel WARN_ON from rtnetlink, and inability to dump the interface state.

The issue qualifies as a denial-of-service condition affecting network management plane operations. Tools relying on RTM_GETLINK calls cannot retrieve attributes for the misconfigured interface.

Root Cause

The root cause is an inconsistency between size calculation and attribute emission in the macvlan netlink ops. A follow-up commit 55cef78c244d added the missing nla_policy entry for IFLA_MACVLAN_BC_CUTOFF but did not correct the size calculation. The condition port->bc_cutoff != 1 in macvlan_fill_info() is the trigger gate that activates the underestimated allocation.

Attack Vector

Reproduction requires local privileges to create and configure network interfaces. The published reproducer issues three commands:

ip link add macvlan0 link eth0 type macvlan mode bridge
ip link set macvlan0 type macvlan bc_cutoff 0
ip -d link show macvlan0   # fails with -EMSGSIZE

After setting bc_cutoff to 0, any ip link show invocation against the interface returns -EMSGSIZE, logs a kernel warning, and disrupts netlink-based monitoring.

Detection Methods for CVE-2026-53013

Indicators of Compromise

Kernel log entries containing WARN_ON traces originating from rtnetlink_fill_ifinfo or related rtnetlink paths
ip link show commands returning RTNETLINK answers: Message too long for macvlan interfaces
Network management agents reporting failures enumerating macvlan devices

Detection Strategies

Audit kernel ring buffer output with dmesg -T | grep -i 'macvlan\|rtnetlink' for warning traces
Inventory macvlan interfaces and query their bc_cutoff value to identify non-default configurations
Cross-reference running kernel version against vendor advisories listing the fix commits

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on WARN_ON events from net/core/rtnetlink.c
Track RTM_GETLINK netlink failures from orchestration agents such as systemd-networkd, NetworkManager, and CNI plugins
Monitor for unexpected macvlan creation events on production hosts using audit rules on ip and iproute2 binaries

How to Mitigate CVE-2026-53013

Immediate Actions Required

Apply the upstream stable kernel commits referenced in the kernel.org stable tree to all affected hosts
Reboot affected systems after kernel update to load the patched code paths
Avoid setting bc_cutoff to any value other than 1 on production macvlan interfaces until patched

Patch Information

The vulnerability is resolved across multiple stable branches. Relevant fix commits include 1c004f14, 49792527, 77ecfa4e, b6b7154e, and fa92a77b. The fix adds nla_total_size(4) for IFLA_MACVLAN_BC_CUTOFF inside macvlan_get_size().

Workarounds

Leave bc_cutoff at its default value of 1 to avoid triggering the size mismatch
Restrict CAP_NET_ADMIN to trusted administrators using namespace and capability controls
Recreate any affected macvlan interface without the bc_cutoff parameter to restore netlink dump behavior

bash

# Reset macvlan interface to default bc_cutoff to avoid the bug
ip link delete macvlan0
ip link add macvlan0 link eth0 type macvlan mode bridge
ip -d link show macvlan0