CVE-2026-53131: Linux Kernel Privilege Escalation Bug

CVE-2026-53131 Overview

CVE-2026-53131 is a Linux kernel vulnerability in the netfilter subsystem. Several netfilter components access the Ethernet header of a socket buffer (skb) through eth_hdr(skb) without first verifying that the buffer is associated with an Ethernet device or that the MAC header has been set. Affected paths include ip6t_eui64, xt_mac, the bitmap:ip,mac, hash:ip,mac, and hash:mac ipset types, and nf_log_syslog. The fix requires these paths to confirm the skb belongs to an Ethernet device, that the MAC header is set, and that it spans at least a full Ethernet header before dereferencing eth_hdr(skb).

Critical Impact
Packet processing paths in netfilter may read memory outside the intended Ethernet header on non-Ethernet skbs, leading to out-of-bounds reads in kernel space.

Affected Products

Linux kernel netfilter subsystem (ip6t_eui64, xt_mac)
Linux kernel ipset types: bitmap:ip,mac, hash:ip,mac, hash:mac
Linux kernel nf_log_syslog module

Discovery Timeline

2026-06-25 - CVE-2026-53131 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53131

Vulnerability Analysis

The flaw stems from netfilter code paths that call eth_hdr(skb) without first verifying the skb originates from an Ethernet device. eth_hdr(skb) returns skb_mac_header(skb) cast to struct ethhdr *. When the skb is associated with a non-Ethernet device, or when the MAC header was not set, the pointer can reference memory that does not represent a valid Ethernet header.

The pre-patch checks were insufficient. Some sites assumed the skb was on an Ethernet device. Others only verified that ETH_HLEN bytes at skb_mac_header(skb) lay between skb->head and skb->data. Neither check confirms the data is actually an Ethernet header.

Attackers controlling packet ingress on non-Ethernet interfaces could trigger reads of unrelated memory regions in the kernel. This can cause incorrect matching decisions in netfilter rules, logging of incorrect MAC values, or kernel memory disclosure through side channels.

Root Cause

The root cause is missing validation before pointer dereference. The affected netfilter and ipset paths trust that skb_mac_header(skb) points to a complete Ethernet header. They do not check skb->dev->type == ARPHRD_ETHER, nor do they confirm via skb_mac_header_was_set(skb) that the MAC header offset has been initialized. This is an out-of-bounds read [CWE-125] resulting from improper input validation.

Attack Vector

Exploitation requires the ability to send packets that traverse netfilter rules referencing the affected match types or ipset types, or that are logged by nf_log_syslog, on a system where the receiving interface is not Ethernet. Tunnel interfaces, loopback, and other link types that lack an Ethernet header are candidate triggers. No authentication is required at the kernel boundary; any source able to deliver such packets to the affected processing paths can trigger the unsafe access.

No public proof-of-concept code is associated with this CVE. Readers should consult the upstream commits referenced below for the exact validation logic added by the maintainers.

Detection Methods for CVE-2026-53131

Indicators of Compromise

Unexpected kernel warnings or KASAN out-of-bounds read reports referencing eth_hdr, ip6t_eui64, xt_mac, nf_log_syslog, or ipset match functions.
Anomalous netfilter rule match outcomes on non-Ethernet interfaces such as tunnels, lo, or ppp.
Syslog entries from nf_log_syslog containing implausible MAC address values for traffic arriving on non-Ethernet links.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the out-of-bounds reads in the affected functions.
Audit netfilter and ipset rule sets for use of xt_mac, ip6t_eui64, and mac-based ipset types on hosts that also expose non-Ethernet interfaces.
Correlate kernel ring buffer entries (dmesg) with packet traces to identify mismatches between interface type and logged MAC headers.

Monitoring Recommendations

Forward kernel logs to a central log store and alert on stack traces involving eth_hdr callers listed in the advisory.
Track installed kernel versions across the fleet and flag hosts running unpatched stable branches referenced in the upstream commits.
Monitor changes to netfilter and ipset configurations that introduce MAC-based matches on hosts with virtual or tunnel interfaces.

How to Mitigate CVE-2026-53131

Immediate Actions Required

Apply the upstream Linux kernel patches that add the Ethernet device, MAC header set, and header length checks before eth_hdr(skb) use.
Update to a distribution kernel that incorporates the referenced stable-tree commits.
Inventory hosts using MAC-based netfilter matches or ipset types and prioritize them for patching.

Patch Information

Fixes are available in the upstream Linux kernel stable trees. The relevant commits add validation that the skb originates from an Ethernet device, that skb_mac_header_was_set(skb) is true, and that the MAC header spans a full Ethernet header before any eth_hdr(skb) dereference. See the upstream commits: Kernel Git Commit 063f433, Kernel Git Commit 367abc, Kernel Git Commit 443588, Kernel Git Commit 5d634a, Kernel Git Commit 62443d, Kernel Git Commit 726abd, and Kernel Git Commit cea435.

Workarounds

Remove or replace MAC-based netfilter matches (xt_mac, ip6t_eui64) and MAC-typed ipsets on hosts where the affected interfaces are exposed to untrusted traffic.
Disable nf_log_syslog logging targets on rules that may match traffic on non-Ethernet interfaces until patches are applied.
Restrict packet ingress on non-Ethernet interfaces using rules that do not require Ethernet header inspection.

bash

# Verify the running kernel version and presence of affected modules
uname -r
lsmod | grep -E 'xt_mac|ip6t_eui64|nf_log_syslog|ip_set'

# Identify rules using MAC-based matches that should be reviewed
iptables -S | grep -i 'mac'
ip6tables -S | grep -i 'eui64'
ipset list -t | grep -E 'mac'