CVE-2026-53001
Description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtables: restrict several matches to inet family
This is a partial revert of:
commit ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
to allow ipv4 and ipv6 only.
- xt_mac
- xt_owner
- xt_physdev
These extensions are not used by ebtables in userspace.
Moreover, xt_realm is only for ipv4, since dst->tclassid is ipv4
specific.
Summary dbcve.org
The Linux kernel netfilter/xtables subsystem incorrectly allowed several match extensions (xt_mac, xt_owner, xt_physdev, xt_realm) to operate with NFPROTO_UNSPEC (both IPv4 and IPv6 families). The xt_realm match uses dst->tclassid which is IPv4-specific, and the other extensions are not used by ebtables in userspace. This misconfiguration could lead to incorrect behavior or crashes when these matches are applied to the wrong IP family.
Mitigation
Apply the kernel security update containing this fix, which restricts these match extensions to inet family (IPv4/IPv6) as appropriate. For xt_realm specifically, restrict to IPv4 only.