CVE-2026-53014
Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir
In tcf_blockcast_redir(), when iterating block ports to redirect
packets to multiple devices, the mac_header_xmit flag is queried
from the wrong device. The loop sends to dev_prev but queries
dev_is_mac_header_xmit(dev) — which is the NEXT device in the
iteration, not the one being sent to.
This causes tcf_mirred_to_dev() to make incorrect decisions about
whether to push or pull the MAC header. When the block contains
mixed device types (e.g., an ethernet veth and a tunnel device),
intermediate devices get the wrong mac_header_xmit flag, leading to
skb header corruption. In the worst case, skb_push_rcsum with an
incorrect mac_len can exhaust headroom and panic.
The last device in the loop is handled correctly (line 365-366 uses
dev_is_mac_header_xmit(dev_prev)), confirming this is a copy-paste
oversight for the intermediate devices.
Fix by using dev_prev instead of dev for the mac_header_xmit query,
consistent with the device actually being sent to.
Summary dbcve.org
In the Linux kernel's net/sched act_mirred module, the tcf_blockcast_redir() function incorrectly queries the mac_header_xmit flag from the wrong device during packet redirection to multiple devices. The code uses 'dev' (the next device in iteration) instead of 'dev_prev' (the actual device being sent to), causing tcf_mirred_to_dev() to make incorrect MAC header push/pull decisions. When the block contains mixed device types (e.g., ethernet veth and tunnel device), this leads to skb header corruption and potential kernel panic via skb_push_rcsum with incorrect mac_len.
Mitigation
Apply the kernel patch to correct the mac_header_xmit query from 'dev' to 'dev_prev' in tcf_blockcast_redir(), then rebuild and reboot the kernel. Avoid using mixed device types in act_mirred block configurations until the fix is applied.