CVE-2026-53013

MediumCVSS 5.5/10Last modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF

macvlan_get_size() does not account for IFLA_MACVLAN_BC_CUTOFF, but macvlan_fill_info() conditionally includes it when port->bc_cutoff != 1. This causes nla_put_s32() to fail with -EMSGSIZE when the netlink skb runs out of space, triggering a WARN_ON in rtnetlink and preventing the interface from being dumped.

The bug can be reproduced with:

ip link add macvlan0 link eth0 type macvlan mode bridge ip link set macvlan0 type macvlan bc_cutoff 0 ip -d link show macvlan0 # fails with -EMSGSIZE

The bc_cutoff feature was added in commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff"), which added the nla_put_s32() call in macvlan_fill_info() but missed adding the corresponding nla_total_size(4) in macvlan_get_size(). A follow-up commit 55cef78c244d ("macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF") fixed the missing nla_policy entry but still did not fix the size calculation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < 4979252758387b338ca968ba7e0515b0ae2257e3; >= 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < 77ecfa4e27f282d224215895ddfbeb916fc75e24; >= 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < b6b7154e9f5d75b608ceb2d05b376de8c638c40e; >= 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < 1c004f14ccdc11585625c168bb9a7c5e1b8afb0c; >= 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < fa92a77b0ed4d5f11a71665a232ac5a54a4b055d
LinuxLinux6.4

References

Timeline

Published
Jun 24, 2026
Last modified
Nov 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-530145.5In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcCVE-2026-530155.5In the Linux kernel, the following vulnerability has been resolved: erofs: unify lcn as u64 for 32-bit platforms As sashiko reported [1], CVE-2026-530167.8In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccpCVE-2026-530175.5In the Linux kernel, the following vulnerability has been resolved: f2fs: fix data loss caused by incorrect use of nat_entry flag Data losCVE-2026-530185.5In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid reading already updated pages during GC We found the folloCVE-2026-530195.5In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc() CVE-2026-53028.1CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the sCVE-2026-530207.8In the Linux kernel, the following vulnerability has been resolved: um: Fix potential race condition in TLB sync During the TLB sync, we nCVE-2026-530215.5In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix integer overflow in UNMAP bounds check sbc_exeCVE-2026-530225.5In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: bound enumeration string aggregation poCVE-2026-530235.5In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: terminate the cached volume label after UTF-8 conversion ntfCVE-2026-530247.8In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free if write is called after disconnect I
CVE-2026-53013: Medium severity, CVSS 5.5 | Vulnix