CVE-2026-53014: Linux Kernel tc Mirroring Header Corruption and DoS

Technical summary

The flaw exists in net/sched/act_mirred.c within the tcf_blockcast_redir() function. When iterating over a block's ports to send mirrored packets to multiple devices, the code stores the previous device in dev_prev but incorrectly queries dev_is_mac_header_xmit(dev)—checking the next device in the loop rather than the one being transmitted to. This mismatch causes tcf_mirred_to_dev() to make wrong decisions about MAC header handling (push vs. pull operations). For intermediate devices, this results in incorrect skb header adjustments. The final device is handled correctly (line 365-366), indicating this is a copy-paste error. The fix replaces the dev reference with dev_prev in the mac_header_xmit query to match the actual transmission target. In mixed device-type scenarios, incorrect header operations can exhaust skb headroom, triggering a panic via skb_push_rcsum.

Business impact

Systems relying on Linux tc mirroring rules across heterogeneous network devices face kernel stability risks. A local attacker or system administrator can configure malicious tc rules to trigger kernel panics, causing denial of service. This is particularly problematic in multi-tenant container environments or systems where unprivileged users have limited networking configuration privileges. Infrastructure that mirrors traffic for monitoring or packet duplication may experience unexpected restarts if mixed device types are mirrored together.

Affected systems

The vulnerability affects the Linux kernel. Any system running a kernel version with the vulnerable act_mirred code and configured to use tc mirroring rules (tcf_blockcast_redir) is at risk, particularly those using mixed device types (e.g., veth pairs alongside tunnel devices) in the same traffic control block.

Exploitability

Exploitation requires local access and the ability to configure tc rules, typically requiring root or CAP_NET_ADMIN privilege. The attack is straightforward: craft a tc filter that mirrors packets across a block containing mixed device types. No special timing, user interaction, or race conditions are required. The impact is denial of service through kernel panic rather than code execution or privilege escalation.

Remediation

Apply the kernel patch that corrects the device reference in tcf_blockcast_redir() to use dev_prev instead of dev when querying the mac_header_xmit flag. This ensures the queried device matches the device actually receiving the packet. Patch details and affected kernel versions should be verified against the official Linux kernel advisory and your distribution's security notices.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates addressing this issue. The fix is a one-line or minimal change to the act_mirred.c file in the networking scheduling subsystem. When patches become available, prioritize deployment to systems configured with tc mirroring rules, particularly those mixing different device types. Verify the patch version against your kernel version before applying.

Detection guidance

Monitor system logs for kernel panics (oops/BUG messages) occurring immediately after tc rule configuration or when traffic matching those rules is processed. Look for panic backtraces involving tcf_mirred_to_dev() or skb_push_rcsum. If possible, audit tc rule configurations on your systems using `tc filter show` and `tc qdisc show` to identify mirroring rules targeting multiple mixed device types. In containerized environments, watch for unexpected restarts of systems where tc mirroring is active.

Why prioritize this

Although this is a CVSS 5.5 Medium vulnerability limited to local exploitation, it directly threatens kernel stability in environments using advanced tc features. Systems with unprivileged user networking access or multi-tenant deployments where traffic control is delegated warrant quicker patching. The simplicity of the triggering mechanism (just configuring a tc rule) and the direct denial-of-service impact justify prompt remediation, though it is lower priority than remote vulnerabilities or those affecting default configurations.

Risk score, explained

CVSS 3.1 assigns 5.5 (MEDIUM) based on local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact (I:N), and high availability impact (A:H). The score reflects the kernel panic denial-of-service risk tempered by the requirement for local administrative capability. The actual operational risk is context-dependent: higher in multi-tenant or delegated networking scenarios, lower in single-tenant production systems where tc configuration is strictly controlled.

Frequently asked questions