|
ELS
< Back

CVE-2026-52942

Updated on 24 Jun 2026

Severity

7.0 High severity

Details

CVSS score
7.0
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_log: validate MAC header was set before dumping it

The fallback path of dump_mac_header() guards the MAC header access only with “skb->mac_header != skb->network_header”, without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log.

This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed).

Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before.

BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265)

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 7 ELS , Debian 10 ELS , Debian 11 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:
kernel @ 3.10.0 (+16 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Amazon Linux 2023 Planned —
CentOS 7 ELS Released
36 kernels
  • 3.10.0-1160.119.1.el7.tuxcare.els10
  • 3.10.0-1160.119.1.el7.tuxcare.els4
  • 3.10.0-1160.119.1.el7.tuxcare.els6
  • 3.10.0-1160.119.1.el7.tuxcare.els15
  • 3.10.0-1160.119.1.el7.tuxcare.els5
  • 3.10.0-1160.119.1.el7.tuxcare.els3
  • 3.10.0-1160.119.1.el7.tuxcare.els14
  • 3.10.0-1160.119.1.el7.tuxcare.els16
  • 3.10.0-1160.119.1.el7.tuxcare.els13
  • 3.10.0-1160.119.1.el7.tuxcare.els7
  • 3.10.0-1160.119.1.el7.tuxcare.els12
  • 3.10.0-1160.119.1.el7.tuxcare.els9
  • 3.10.0-1160.119.1.el7.tuxcare.els8
  • 3.10.0-1160.119.1.el7.tuxcare.els17
  • 3.10.0-1160.119.1.el7.tuxcare.els18
  • 3.10.0-1160.119.1.el7.tuxcare.els19
  • 3.10.0-1160.119.1.el7.tuxcare.els20
  • 3.10.0-1160.119.1.el7.tuxcare.els21
  • 3.10.0-1160.119.1.el7.tuxcare.els24
  • 3.10.0-1160.119.1.el7.tuxcare.els22
  • 3.10.0-1160.119.1.el7.tuxcare.els25
  • 3.10.0-1160.139.1.el7.tuxcare.els2
  • 3.10.0-1160.139.1.el7.tuxcare.els3
  • 3.10.0-1160.139.1.el7.tuxcare.els4
  • 3.10.0-1160.142.1.el7.tuxcare.els1
  • 3.10.0-1160.144.1.el7.tuxcare.els1
  • 3.10.0-1160.144.1.el7.tuxcare.els2
  • 3.10.0-1160.144.1.el7.tuxcare.els3
  • 3.10.0-1160.144.1.el7.tuxcare.els4
  • 3.10.0-1160.144.1.el7.tuxcare.els5
  • 3.10.0-1160.144.1.el7.tuxcare.els6
  • 3.10.0-1160.144.1.el7.tuxcare.els8
  • 3.10.0-1160.144.1.el7.tuxcare.els7
  • 3.10.0-1160.144.1.el7.tuxcare.els9
  • 3.10.0-1160.156.1.el7.tuxcare.els1
  • 3.10.0-1160.156.1.el7.tuxcare.els2
Debian 11 In Rollout
44 kernels
  • 5.10.46-5
  • 5.10.70-1
  • 5.10.46-4
  • 5.10.84-1
  • 5.10.92-1
  • 5.10.92-2
  • 5.10.103-1
  • 5.10.106-1
  • 5.10.113-1
  • 5.10.120-1
  • 5.10.127-1
  • 5.10.127-2
  • 5.10.136-1
  • 5.10.140-1
  • 5.10.149-1
  • 5.10.149-2
  • 5.10.158-2
  • 5.10.162-1
  • 5.10.179-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.178-3
  • 5.10.205-2
  • 5.10.205-1
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
  • 5.10.249-1
  • 5.10.251-1
  • 5.10.251-3
  • 5.10.251-4
  • 5.10.251-5
  • 5.10.257-1
  • 5.10.259-1
Debian 11 cloud In Rollout
24 kernels
  • 5.10.113-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.205-2
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
  • 5.10.249-1
  • 5.10.251-1
  • 5.10.251-3
  • 5.10.251-4
  • 5.10.251-5
  • 5.10.257-1
  • 5.10.259-1
Debian 12 Planned —
RHEL 8 Planned —