CVE-2026-52942: Linux Kernel Netfilter MAC Header Buffer Over-Read Information Disclosure

Technical summary

The vulnerability resides in the nf_log_syslog.c dump_mac_header() function within netfilter's logging path. The fallback code path checks whether skb->mac_header differs from skb->network_header, but omits a critical validation: skb_mac_header_was_set(). When a MAC header is unset, the mac_header field contains 0xffff (all bits set), which misleads the inequality check into passing. The resulting call to skb_mac_header() returns a pointer into skb->head offset by 0xffff bytes—roughly 64 KiB past the buffer boundary. The loop then reads dev->hard_header_len bytes out of bounds. Reachability is via the netdev logger: nf_log_unknown_packet() invokes dump_mac_header() unconditionally, and an skb transmitted through AF_PACKET with PACKET_QDISC_BYPASS flag reaches the egress netfilter hook with mac_header still uninitialized (the normal __dev_queue_xmit() path that resets this field is bypassed). The fix adds the missing skb_mac_header_was_set() guard and replaces open-coded MAC header length logic with skb_mac_header_len(). The CWE classification is CWE-125: Out-of-bounds Read.

Business impact

Information disclosure from kernel memory can compromise system confidentiality. An unprivileged local attacker gains the ability to read sensitive kernel state—including cryptographic keys, authentication tokens, or other protected data—and redirect it to the system log where it may be accessible or logged to persistent storage. This weakens the security boundary between user and kernel space. On multi-tenant systems, it enables privilege escalation reconnaissance or lateral movement planning. Systems handling sensitive workloads (databases, key management, payment processing) or subject to strict data residency requirements face elevated risk.

Affected systems

All Linux kernel versions containing the vulnerable netfilter logging code are affected. The vulnerability affects distributions and kernels that enable netfilter and the nf_tables or legacy netfilter rules engine. Systems using AF_PACKET for packet crafting or monitoring (tcpdump, packet sniffers, custom networking tools) and systems with netfilter rules configured are at risk. Verify your kernel version and netfilter configuration status against the vendor advisory for specific patched releases.

Exploitability

Exploitation requires local access and unprivileged execution capability (no special privileges required at trigger time). The attack surface is AF_PACKET with PACKET_QDISC_BYPASS, which is accessible to local users. Triggering is straightforward: send a crafted packet using AF_PACKET while the netdev logger is active (via nftables or iptables logging rules). No special kernel configuration or race conditions are needed. The leaked data appears in kernel logs (dmesg, syslog), making it persistent and observable. Proof-of-concept code exists in public Linux kernel commit history. Exploitation is practical and repeatable for any local user.

Remediation

Apply a kernel update that includes the netfilter MAC header validation fix. The patch adds skb_mac_header_was_set() validation before dereferencing the MAC header pointer and replaces inline length checks with the skb_mac_header_len() helper function. Consult your Linux distribution's security advisory for patched kernel versions and installation instructions. If a patch is not yet available for your distribution, mitigating controls include: disabling AF_PACKET access via AppArmor, SELinux, or seccomp policies; disabling netfilter logging rules if not required; or restricting user access to packet manipulation tools. Permanent remediation requires a kernel upgrade.

Patch guidance

Contact your Linux distribution vendor for patched kernel versions (Red Hat, Ubuntu, Debian, SUSE, etc. each release on their own schedule). Kernel.org git history contains the upstream fix; verify the patch against the kernel version you are running. When patching, reboot is required for kernel updates. Test patches in non-production environments first, especially on systems with complex netfilter rule sets, to ensure no rule interaction issues. Coordinate patching with change windows for production systems.

Detection guidance

Monitor kernel logs (dmesg, journalctl, syslog) for KASAN messages or out-of-bounds read warnings referencing dump_mac_header or nf_log_syslog.c. Systems with KASAN compiled in will emit explicit BUG and slab-out-of-bounds alerts. Examine active netfilter rules (nft list ruleset, iptables -L) to identify logging rules that trigger nf_log_netdev_packet. Correlate system log timestamps with suspicious AF_PACKET activity. Network-based detection is difficult since the malicious packet format is standard; focus on local endpoint monitoring and log analysis. Check for unexpected kernel memory dumps in log files.

Why prioritize this

This vulnerability merits prompt prioritization due to its HIGH CVSS score (7.1), local exploitability with no privilege requirement, information disclosure impact, and practical attack surface via AF_PACKET. While local-only, many systems grant local access to containers, SSH users, or application servers. Kernel memory leaks undermine defense-in-depth and are difficult to detect post-exploitation. Systems with netfilter logging enabled are actively at risk.

Risk score, explained

CVSS 3.1 score of 7.1 (HIGH) reflects: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H) from kernel memory disclosure, no integrity impact (I:N), and high availability impact (A:H) due to potential kernel instability if out-of-bounds read corrupts adjacent structures. The availability impact acknowledges that reading 64 KiB past buffer boundaries could touch uninitialized or protected memory, risking kernel panic or undefined behavior. High severity is appropriate for local information disclosure combined with potential availability degradation.

Frequently asked questions