CVE-2026-53014: Linux Kernel act_mirred DoS Vulnerability

CVE-2026-53014 Overview

CVE-2026-53014 is a Linux kernel vulnerability in the net/sched subsystem, specifically within the act_mirred traffic control action. The flaw resides in tcf_blockcast_redir(), which iterates block ports to redirect packets to multiple devices. The function queries the mac_header_xmit flag from the wrong device during iteration, causing incorrect MAC header handling decisions in tcf_mirred_to_dev(). When a block contains mixed device types such as an ethernet veth alongside a tunnel device, intermediate devices receive the wrong flag value. This results in socket buffer (skb) header corruption and, in the worst case, kernel panic.

Critical Impact
Incorrect mac_header_xmit evaluation can corrupt skb headers and trigger a kernel panic through skb_push_rcsum exhausting headroom, leading to denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the tcf_blockcast_redir() implementation in net/sched/act_mirred.c
Systems using traffic control block-based redirection with mixed device types (e.g., veth and tunnel devices)
Stable kernel branches prior to backport commits referenced by the upstream maintainers

Discovery Timeline

2026-06-24 - CVE-2026-53014 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53014

Vulnerability Analysis

The defect is a copy-paste oversight in the packet redirection loop within tcf_blockcast_redir(). The loop sends packets to dev_prev but queries dev_is_mac_header_xmit(dev), where dev is the next device in the iteration rather than the one being transmitted to. The mismatch causes tcf_mirred_to_dev() to make incorrect decisions about whether to push or pull the MAC header before transmission.

The last device in the loop is handled correctly using dev_is_mac_header_xmit(dev_prev), confirming the bug applies only to intermediate devices. When the traffic control block aggregates devices that disagree on MAC header presence, the flag mismatch propagates header corruption across redirected packets. This classifies as a [Kernel Vulnerability] producing skb integrity violations and potential denial of service.

Root Cause

The root cause is referencing the wrong loop variable when querying the MAC header transmission property. The intermediate iteration step uses dev instead of dev_prev, breaking the invariant that the queried device must match the device actually receiving the redirected skb.

Attack Vector

Exploitation requires a configuration where a traffic control block spans heterogeneous device types with differing mac_header_xmit semantics. A local actor capable of influencing TC configuration or generating redirected traffic across such a block can trigger malformed skb operations. skb_push_rcsum invoked with an incorrect mac_len can exhaust headroom, panicking the kernel and producing a denial of service condition.

No verified public proof-of-concept code is available. Refer to the upstream commits for the patch diff and reproduction context.

Detection Methods for CVE-2026-53014

Indicators of Compromise

Unexpected kernel panics or oops messages referencing skb_push_rcsum, tcf_mirred_to_dev, or tcf_blockcast_redir in dmesg or /var/log/kern.log
Repeated skb headroom exhaustion warnings on hosts running TC act_mirred configurations
Network throughput anomalies or dropped packets on traffic control blocks combining veth and tunnel devices

Detection Strategies

Audit running kernel versions against the fixed commits referenced by the upstream maintainers
Inventory hosts that load act_mirred and configure TC blocks containing mixed device types
Correlate kernel crash telemetry with TC block port enumeration to identify exposure

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log platform and alert on panic signatures involving act_mirred
Track host availability metrics for systems performing high-volume packet redirection
Monitor tc configuration changes through audit subsystem (auditd) rules on /sbin/tc invocations

How to Mitigate CVE-2026-53014

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable tree commits
Reboot affected hosts into the patched kernel to activate the fix in tcf_blockcast_redir()
Identify and document any production TC configurations combining mixed device types within a single block

Patch Information

The fix replaces dev with dev_prev in the dev_is_mac_header_xmit() query so the flag reflects the device actually receiving the packet. Patches are available in the following stable tree commits: Kernel Git Commit 4510d140524, Kernel Git Commit 4764953c4b4, Kernel Git Commit 7db3e4e0303, and Kernel Git Commit 8fda5174286.

Workarounds

Avoid configuring TC blocks that mix MAC-header-transmitting devices (e.g., veth) with non-MAC-header devices (e.g., tunnels)
Restrict privileges required to configure traffic control by limiting CAP_NET_ADMIN to trusted administrators
Remove or unload act_mirred where block-based redirection is not required for operational workloads

bash

# Verify running kernel version and act_mirred module status
uname -r
lsmod | grep act_mirred

# List TC block configurations to inventory exposure
tc filter show block 1