CVE Intelligence
Analysis AI-assisted

CVE-2026-53131: Linux Kernel netfilter: Missing Ethernet MAC Header Validation Before eth_hdr() Access

A netfilter flaw in the Linux kernel allows several modules, including xt_mac, ip6t_eui64, the ipset MAC-based types and nf_log_syslog, to read the Ethernet header without first confirming that the packet belongs to an Ethernet device and has a valid MAC header. The record assigns a CNA CVSS 3.1 score of 9.4 (critical) and lists seven stable-tree patches. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a netfilter issue in the Linux kernel. Several modules read the Ethernet header through eth_hdr(skb) without first confirming that the packet is tied to an Ethernet device and that its MAC header is set and long enough. The fix adds these checks before the access. The upstream description is available in the NVD entry.

Impact

  • The CNA assigns a CVSS 3.1 base score of 9.4 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H, which indicates network reachability, no privileges and no user interaction.
  • The record does not describe the concrete consequence of the missing check.
  • Inference: reading header data beyond the valid buffer could lead to memory errors such as crashes or information exposure. The sources do not confirm which outcome is possible.

Affected products and versions

  • Product in the record: Linux Linux Kernel.
  • Affected ranges in the record: from 2.6.12.1 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13.
  • The record also lists 2.6.12 and the release candidates 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4 and 2.6.12-rc5.
  • Inference: the upper bounds listed (for example 5.15.210 and 7.0.13) appear to be the first versions outside each range. This is not stated explicitly in the record, so verify against your distribution's advisories.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • EPSS data is not available in the record.

Remediation and mitigation

  • The record links seven stable-tree commits that implement the fix. Apply the kernel update from your distribution or from the stable branch that matches your version, as shown in the stable commit 063f43361e884acd7300790e90194430275d0d0c.
  • Inference: where patching is delayed and the affected netfilter modules or ipset types are not needed, reducing their exposure may lower risk. Confirm the impact with your administrators before making changes.
  • Prioritize systems that route or filter traffic, since these are the typical places where netfilter matches run.

Detection guidance

  • Inventory kernel versions and compare them with the ranges listed above.
  • Check whether the affected modules are loaded or used by firewall rules, for example through ipset or xtables configuration.
  • Monitor kernel logs for unexpected crashes or warnings in netfilter components. The record does not provide specific indicators.

Limitations of the available information

  • The record has no CWE classification, no KEV data, no EPSS score and no SSVC data.
  • The record does not describe a proof of concept, the trigger conditions in detail or the exact observable effects.
  • The severity is the CNA score; no independent scoring was present in the record.

Frequently asked questions

What is the core problem in CVE-2026-53131?

Several netfilter components read the Ethernet header without first confirming that the packet is tied to an Ethernet device and that its MAC header is valid and long enough. The patches add these checks.

Is this vulnerability known to be exploited?

The CISA KEV catalog does not list it in this record, and no confirmed exploitation in the wild appears in the sources consulted.

How should administrators respond?

Apply the kernel update from your distribution or the matching stable branch, and compare your kernel version with the affected ranges listed in the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.