CVE-2026-53245: Linux Kernel Privilege Escalation Flaw

CVE-2026-53245 Overview

CVE-2026-53245 is a parsing flaw in the Linux kernel's Multiple Registration Protocol (MRP) implementation. The defect resides in the mrp_pdu_parse_vecattr() function within net/802/mrp, which handles vector attribute decoding for IEEE 802.1ak frames. The parser mishandles three boundary conditions when processing vector attribute events that are encoded three per byte. These errors cause spurious MRP applicant state transitions, offset corruption during subsequent Protocol Data Unit (PDU) parsing, and incorrect attribute value assignment across byte boundaries. The vulnerability affects kernels running MRP for VLAN and multicast registration on 802.1 bridged networks.

Critical Impact
A malformed MRP PDU on a Layer 2 network segment can corrupt MRP applicant state and disrupt VLAN or multicast registration, leading to network reachability and integrity issues.

Affected Products

Linux kernel net/802/mrp subsystem
Systems using the Multiple Registration Protocol for VLAN registration (MVRP) or multicast registration (MMRP)
Bridged Linux network deployments processing IEEE 802.1ak MRP PDUs

Discovery Timeline

2026-06-25 - CVE-2026-53245 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53245

Vulnerability Analysis

The vulnerability resides in mrp_pdu_parse_vecattr(), the function responsible for decoding MRP vector attributes from incoming PDUs. MRP encodes attribute events using a ternary packing scheme of three events per byte, with valen tracking the number of remaining events. The parser correctly decrements valen after the first and second event of each byte but omits the decrement after the third event. When valen is an exact multiple of three, the loop continues beyond the last valid event and consumes an additional byte as a spurious event byte. The parser then applies a fabricated event to the MRP applicant state machine.

A second defect appears when valen is zero. Per IEEE 802.1ak, a VectorAttribute carrying only a LeaveAllEvent has valen of zero and contains no FirstValue or vector fields. The current parser unconditionally consumes attrlen bytes as FirstValue and advances the offset, corrupting the offset for the next PDU element. A third defect occurs when valen exceeds three: as the loop crosses byte boundaries, the attribute value is not incremented between the third event of one byte and the first event of the next byte.

Root Cause

The root cause is incorrect loop accounting in the MRP vector attribute parser. The function fails to decrement the event counter on the third event of each byte, fails to skip FirstValue consumption when valen is zero, and fails to increment the attribute value at each iteration boundary. This is an input validation and parser state management defect [CWE-20].

Attack Vector

An attacker on the same Layer 2 broadcast domain can craft an MRP PDU with carefully chosen valen values to trigger any of the three parsing defects. A valen value that is an exact multiple of three injects a spurious event into the applicant state machine. A valen value of zero with a non-empty body corrupts offset tracking for subsequent attributes in the same PDU. Vector attributes with valen greater than three cause attribute value drift across byte boundaries, resulting in events being applied to incorrect VLAN or multicast group identifiers.

The vulnerability manifests through malformed PDU structure rather than through code execution primitives. See the upstream commits referenced in the Linux kernel stable tree for the corrected parsing logic.

Detection Methods for CVE-2026-53245

Indicators of Compromise

Unexpected VLAN registration or deregistration events on bridged interfaces using MVRP
Multicast group membership changes that do not correlate with legitimate host activity
MRP PDU parsing errors or anomalous applicant state transitions in kernel logs
Layer 2 traffic containing MRP frames with valen values of zero, multiples of three, or values exceeding three from untrusted sources

Detection Strategies

Monitor kernel ring buffer output via dmesg for MRP subsystem warnings and unexpected state machine transitions
Capture Layer 2 traffic with tcpdump -i <iface> ether proto 0x88f5 to inspect MRP PDUs for malformed vector attribute lengths
Correlate VLAN topology changes against switch port configuration baselines to detect unauthorized MVRP registrations

Monitoring Recommendations

Forward kernel and network subsystem logs to a centralized log platform for retrospective analysis of MRP anomalies
Track running kernel versions across the Linux fleet and flag hosts that have not received the patched stable release
Enable interface-level counters for MRP frame receipt on edge ports where MRP should not legitimately appear

How to Mitigate CVE-2026-53245

Immediate Actions Required

Apply the upstream Linux kernel patches that fix mrp_pdu_parse_vecattr() from the stable tree commits listed in the references
Restrict MRP traffic to trusted ports by disabling MVRP and MMRP on edge ports facing untrusted hosts
Inventory systems where MRP is enabled and prioritize patching for bridges and switches running on Linux

Patch Information

The fix is distributed across multiple Linux stable branches. Reference commits include 36d2597, 42446ca, 6d6e42e, 6eea649, 7561c7f, ae65714, cc98717, and fd9c3a4. The patch decrements valen after the third event of each byte, skips FirstValue consumption when valen is zero, and increments the attribute value at the end of each loop iteration.

Workarounds

Unload the mrp kernel module on systems that do not require MVRP or MMRP functionality using modprobe -r mrp
Blacklist the mrp module to prevent automatic load on reboot when MRP is not in use
Apply ingress filtering on bridge ports to drop frames matching EtherType 0x88f5 from untrusted segments

bash

# Disable and blacklist the MRP module on hosts that do not need it
sudo modprobe -r mrp
echo "blacklist mrp" | sudo tee /etc/modprobe.d/blacklist-mrp.conf

# Drop MRP PDUs on untrusted bridge ports using ebtables
sudo ebtables -A INPUT -i <untrusted-port> -p 0x88f5 -j DROP