netfilter: nf_log: validate MAC header was set before dumping it
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log. This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed). Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before. BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.
CVE-2026-52942
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-52942
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7eb9282cd0efac08b8377cbd5037ba297c77e3f7",
"lessThan": "2e96e1bc9b4d5450e6c33f078e19a9bc1dda6c0b",
"versionType": "git"
},
{
"status": "affected",
"version": "7eb9282cd0efac08b8377cbd5037ba297c77e3f7",
"lessThan": "d704ee9c7bc68a161684c51a7ac05b446dcf38d4",
"versionType": "git"
},
{
"status": "affected",
"version": "7eb9282cd0efac08b8377cbd5037ba297c77e3f7",
"lessThan": "befb8968a2abdfa948d5600ea7f7a509a292a590",
"versionType": "git"
},
{
"status": "affected",
"version": "7eb9282cd0efac08b8377cbd5037ba297c77e3f7",
"lessThan": "8a81e336da685423f5b64aac4d571e63d674c52a",
"versionType": "git"
},
{
"status": "affected",
"version": "7eb9282cd0efac08b8377cbd5037ba297c77e3f7",
"lessThan": "c38d41134085193efd5b237cf513ad5b3421a60d",
"versionType": "git"
},
{
"status": "affected",
"version": "7eb9282cd0efac08b8377cbd5037ba297c77e3f7",
"lessThan": "af1b7699466f6556b351fa25d3dc870abfb5d310",
"versionType": "git"
},
{
"status": "affected",
"version": "7eb9282cd0efac08b8377cbd5037ba297c77e3f7",
"lessThan": "65ef7397eb9a296e91839f5fd10be96f23d332e7",
"versionType": "git"
},
{
"status": "affected",
"version": "7eb9282cd0efac08b8377cbd5037ba297c77e3f7",
"lessThan": "a84b6fedbc97078788be78dbdd7517d143ad1a77",
"versionType": "git"
}
],
"programFiles": [
"net/netfilter/nf_log_syslog.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.36",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/netfilter/nf_log_syslog.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-52942
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40702 · Revision 1
- Added to Heist Feed
- Publisher date