CVE-2026-53014

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

In tcf_blockcast_redir(), when iterating block ports to redirect

packets to multiple devices, the mac_header_xmit flag is queried

from the wrong device. The loop sends to dev_prev but queries

dev_is_mac_header_xmit(dev) — which is the NEXT device in the

iteration, not the one being sent to.

This causes tcf_mirred_to_dev() to make incorrect decisions about

whether to push or pull the MAC header. When the block contains

mixed device types (e.g., an ethernet veth and a tunnel device),

intermediate devices get the wrong mac_header_xmit flag, leading to

skb header corruption. In the worst case, skb_push_rcsum with an

incorrect mac_len can exhaust headroom and panic.

The last device in the loop is handled correctly (line 365-366 uses

dev_is_mac_header_xmit(dev_prev)), confirming this is a copy-paste

oversight for the intermediate dev

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References