CVE-2026-53013: Linux Kernel macvlan Size Reservation Vulnerability

Technical summary

The vulnerability exists in the macvlan_get_size() function, which calculates the netlink message buffer size needed to report interface attributes. The function fails to account for the IFLA_MACVLAN_BC_CUTOFF attribute (a 32-bit signed integer), but macvlan_fill_info() conditionally includes this attribute when port->bc_cutoff != 1. This size mismatch causes nla_put_s32() to fail with -EMSGSIZE, triggering a WARN_ON condition in rtnetlink. The broadcast cutoff feature was introduced in an earlier commit but the corresponding size calculation was omitted. A subsequent patch addressed the missing nla_policy definition but did not fix the underlying size reservation issue.

Business impact

This vulnerability affects system administrators and automation tools that rely on network interface discovery and configuration. Tools querying macvlan interface attributes may hang or fail to retrieve interface state, disrupting network automation, monitoring, and orchestration workflows. In containerized or virtualized environments where macvlan bridges are common for network segmentation, this could prevent proper inventory and compliance auditing of network configurations.

Affected systems

The Linux kernel is affected, specifically systems running kernel versions containing the macvlan driver with the broadcast cutoff feature. This impacts any Linux host using macvlan interfaces in bridge mode with non-default bc_cutoff values. The vulnerability is most relevant to containerized deployments, virtual machine hosts, and network edge devices where macvlan bridging provides tenant isolation.

Exploitability

Exploitation requires local access and the ability to configure network interfaces (typically requiring root or CAP_NET_ADMIN capability). The vulnerability is trivial to trigger once a macvlan interface is created and the bc_cutoff parameter is modified from its default. No special tools, elevated remote access, or race conditions are necessary. However, the impact is localized to interface reporting—it does not compromise data confidentiality, integrity, or enable privilege escalation.

Remediation

Apply a kernel patch that adds the missing nla_total_size(4) reservation for IFLA_MACVLAN_BC_CUTOFF in the macvlan_get_size() function. Verify the patch against your kernel distribution's advisory. As a temporary workaround, avoid setting bc_cutoff to non-default values on production macvlan interfaces until the kernel is updated.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates addressing this macvlan size calculation bug. Patches should be verified against the distribution's release notes or kernel stable series commits. Test kernel updates in a non-production environment first, as they may require system reboots. Organizations on supported kernel versions (stable or LTS) should prioritize testing and deployment within standard maintenance windows.

Detection guidance

Monitor system logs for WARN_ON messages from rtnetlink when querying network interface attributes. Test your environment by running 'ip -d link show' on any macvlan interfaces; failures to display interface details or EMSGSIZE errors in dmesg indicate exposure. Scan for macvlan interfaces with non-default bc_cutoff values using 'ip link show' and 'ip -d link show macvlan<N>' commands. Automated configuration management tools that enumerate network state should be tested to ensure they can successfully query all interface attributes.

Why prioritize this

This medium-severity vulnerability merits prompt attention because it directly impacts network observability and automation reliability. While local access is required, the trivial trigger mechanism and potential for widespread impact on network management make it a priority for infrastructure teams. Organizations relying on programmatic interface discovery for compliance, monitoring, or orchestration should prioritize patching to maintain operational continuity.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local-access requirement (AV:L), low complexity (AC:L), and requirement for low privilege (PR:L). The vulnerability causes availability impact (A:H) by preventing interface reporting, but does not compromise confidentiality or integrity. The lack of network-reachability or root-privilege requirements moderates the score compared to remote kernel vulnerabilities.

Frequently asked questions