CVE-2026-53238: Linux Kernel Privilege Escalation Flaw

CVE-2026-53238 Overview

CVE-2026-53238 is a Linux kernel vulnerability in the NetLabel subsystem. The function netlbl_unlabel_addrinfo_get() validates the length of the address attribute when parsing a Generic Netlink request, but fails to independently validate the corresponding mask attribute length. A crafted Generic Netlink request can supply a valid IPv4 or IPv6 address attribute alongside an undersized mask attribute, which the kernel then reads as a full struct in_addr or struct in6_addr. This results in an out-of-bounds read inside kernel memory during NetLabel unlabeled address processing.

Critical Impact
A local attacker capable of sending Generic Netlink requests to the NetLabel subsystem can trigger an out-of-bounds read of kernel memory, leading to information disclosure or denial of service.

Affected Products

Linux kernel (NetLabel subsystem, net/netlabel/netlabel_unlabeled.c)
Multiple stable Linux kernel branches receiving backported fixes
Distributions shipping vulnerable kernel versions prior to the referenced commits

Discovery Timeline

2026-06-25 - CVE-2026-53238 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53238

Vulnerability Analysis

The NetLabel subsystem handles unlabeled IPv4 and IPv6 address configuration through Generic Netlink. Inside netlbl_unlabel_addrinfo_get(), the kernel inspects the length of the address attribute (NLBL_UNLABEL_A_IPV4ADDR or NLBL_UNLABEL_A_IPV6ADDR) to determine whether the caller intends an IPv4 or IPv6 operation. The function then reads the mask attribute (NLBL_UNLABEL_A_IPV4MASK or NLBL_UNLABEL_A_IPV6MASK) as a full struct in_addr or struct in6_addr without verifying that the supplied mask matches the expected size.

Because the netlink policy declared these attributes with NLA_BINARY, the policy treated the declared length as a maximum rather than an exact requirement. A request carrying a properly sized address attribute and a truncated mask attribute therefore passed policy validation. The kernel subsequently dereferenced memory past the actual attribute payload, producing an out-of-bounds read [CWE-125].

Root Cause

The root cause is improper input validation in the Generic Netlink attribute policy for unlabeled NetLabel address and mask attributes. NLA_BINARY enforces only an upper bound on attribute length, allowing shorter inputs to pass validation while downstream code assumes a fixed structure size.

Attack Vector

A local user able to send Generic Netlink messages to the NetLabel family can craft a request that pairs a full-length address attribute with a shorter mask attribute. Processing this request causes the kernel to read beyond the attribute buffer, potentially leaking adjacent kernel memory contents or causing instability. NetLabel operations typically require CAP_NET_ADMIN, which constrains exposure to privileged local contexts and container scenarios where that capability is granted.

No verified public exploit code is available. The fix replaces the NLA_BINARY policy entries with NLA_POLICY_EXACT_LEN() for both address and mask attributes, ensuring that short attributes are rejected during policy validation and that exact length requirements are exposed through policy introspection. Patch details are available in the Kernel Git Commit 07a18f5 and additional backports.

Detection Methods for CVE-2026-53238

Indicators of Compromise

Unexpected EINVAL or netlink validation failures originating from the NetLabel Generic Netlink family after patching.
Kernel logs showing crashes, KASAN out-of-bounds read reports, or panics in netlbl_unlabel_addrinfo_get() or surrounding NetLabel code paths.
Unusual processes invoking NetLabel configuration interfaces without administrative justification.

Detection Strategies

Audit running kernel versions against the patched commits referenced in the Linux stable tree to identify exposed hosts.
Enable kernel address sanitizer (KASAN) in test environments to surface out-of-bounds reads triggered by NetLabel attribute parsing.
Monitor auditd records for netlink socket activity targeting the NLBL_UNLBL Generic Netlink family from unexpected user contexts.

Monitoring Recommendations

Collect kernel ring buffer output (dmesg) centrally and alert on oops, BUG, or KASAN reports referencing netlabel symbols.
Track usage of CAP_NET_ADMIN inside containers and unprivileged workloads, since NetLabel configuration is gated by this capability.
Correlate netlink syscall telemetry with process identity to identify anomalous Generic Netlink configuration attempts.

How to Mitigate CVE-2026-53238

Immediate Actions Required

Upgrade affected Linux kernels to a version that includes the NetLabel attribute length validation fix from the upstream stable tree.
Apply distribution vendor kernel updates as they become available and reboot affected hosts to load the patched kernel.
Restrict CAP_NET_ADMIN to trusted workloads and avoid granting it to containers that do not require network administration.

Patch Information

The upstream fix replaces NLA_BINARY with NLA_POLICY_EXACT_LEN() for the unlabeled IPv4 and IPv6 address and mask attributes in net/netlabel/netlabel_unlabeled.c. Backports are tracked across multiple stable branches, including Kernel Git Commit 07a18f5, Kernel Git Commit 0c4bb32, Kernel Git Commit 672f0f3, Kernel Git Commit 71c52da, Kernel Git Commit 95bda3e, Kernel Git Commit 975a84f, Kernel Git Commit 9772589, and Kernel Git Commit ccfe292.

Workarounds

Where NetLabel functionality is not required, build or boot kernels with CONFIG_NETLABEL disabled to remove the vulnerable code path.
Drop CAP_NET_ADMIN from container security profiles and seccomp policies to prevent untrusted workloads from issuing NetLabel Generic Netlink requests.
Use Linux Security Modules such as SELinux or AppArmor to restrict which processes may open netlink sockets and interact with the NetLabel family.

bash

# Verify whether NetLabel is enabled in the running kernel
zgrep CONFIG_NETLABEL /proc/config.gz 2>/dev/null || \
  grep CONFIG_NETLABEL /boot/config-$(uname -r)

# Inspect current NetLabel unlabeled configuration
netlabelctl unlbl list

# Drop CAP_NET_ADMIN when running untrusted containers (Docker example)
docker run --cap-drop=NET_ADMIN <image>