CVE-2026-53014 - net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

Back Back to CVE browser

MEDIUM

net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

Published Jun 24, 2026

5.5

MEDIUM

CVSS 3.1

EPSS 0.16%

Description

In tcf_blockcast_redir(), when iterating block ports to redirect packets to multiple devices, the mac_header_xmit flag is queried from the wrong device. The loop sends to dev_prev but queries dev_is_mac_header_xmit(dev) — which is the NEXT device in the iteration, not the one being sent to.

This causes tcf_mirred_to_dev() to make incorrect decisions about whether to push or pull the MAC header. When the block contains mixed device types (e.g., an ethernet veth and a tunnel device), intermediate devices get the wrong mac_header_xmit flag, leading to skb header corruption. In the worst case, skb_push_rcsum with an incorrect mac_len can exhaust headroom and panic.

The last device in the loop is handled correctly (line 365-366 uses dev_is_mac_header_xmit(dev_prev)), confirming this is a copy-paste oversight for the intermediate devices.

Fix by using dev_prev instead of dev for the mac_header_xmit query, consistent with the device actually being sent to.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  6.8
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <6.8
- Version
  6.12.91
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.33
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  7.0.10
  Status
  unaffected
  Constraints
  <=7.0.*
- Version
  7.1
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
6.8	affected	-
0	unaffected	<6.8
6.12.91	unaffected	<=6.12.*
6.18.33	unaffected	<=6.18.*
7.0.10	unaffected	<=7.0.*
7.1	unaffected	<=*

Red Hat Enterprise Linux 10

kernel

Fix deferred
Red Hat Enterprise Linux 6

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 6	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-805

References (9)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-53014		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2492333		Issue Tracking
https://git.kernel.org/stable/c/4510d140524ca7d6e772db962e013f26f09a63b1		Patch
https://git.kernel.org/stable/c/4764953c4b47585eb72797b216b63a831dc0c7e6		Patch
https://git.kernel.org/stable/c/7db3e4e03032261b1b519341123fc30d995478ca		Patch
https://git.kernel.org/stable/c/8fda5174286119addd28473fb2ec5bdf521c05a8		Patch
https://lore.kernel.org/linux-cve-announce/2026062450-CVE-2026-53014-3438@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53014
https://www.cve.org/CVERecord?id=CVE-2026-53014