CVE-2026-53245: Linux Kernel MRP Vector Attribute Parsing Denial of Service

Technical summary

CVE-2026-53245 is a vector attribute parsing defect in net/802/mrp.c, specifically in the mrp_pdu_parse_vecattr() function. MRP encodes three event values per byte; the vulnerable code decrements the event counter (valen) after processing the first and second events but omits this decrement after the third event. When valen equals a multiple of three, this off-by-one error causes the loop to consume an extra byte and apply an invalid event to the applicant state machine. Additionally, the function unconditionally consumes FirstValue bytes even when valen is zero—a valid case per IEEE 802.1ak where a VectorAttribute contains only a LeaveAllEvent with no FirstValue or Vector fields, corrupting subsequent PDU offset calculations. A third defect occurs when valen exceeds three: the attribute value is not incremented at byte boundaries, causing the first event of the next byte to reuse the previous byte's attribute value instead of advancing to the next consecutive value. The fix requires decrementing valen after the third event, skipping FirstValue consumption when valen is zero, and incrementing the attribute value at each loop iteration.

Business impact

This vulnerability could disrupt network redundancy on systems where MRP is actively deployed—typically industrial networks, automotive CAN-bus environments, and enterprise switching fabrics that rely on Media Redundancy Protocol for fast failover. A local attacker with network access can craft malicious MRP frames to trigger denial of service by corrupting the kernel's state machine or causing parsing errors that crash protocol handling. While the attack surface requires local network access (not remote), MRP environments often span trusted internal networks where an attacker with any network presence could exploit this. The impact is availability-focused: the kernel will not execute arbitrary code, but legitimate MRP failover logic may fail or the kernel may panic, causing unplanned downtime in systems dependent on MRP redundancy.

Affected systems

All versions of the Linux kernel containing the vulnerable mrp_pdu_parse_vecattr() function are affected. This includes both older and current kernel releases until the fix is applied. The vulnerability is specific to systems with MRP compiled into the kernel or loaded as a module (CONFIG_802_1Q_VLAN_GRO_REMIT or similar MRP-related kernel configurations). Systems not using Media Redundancy Protocol are not vulnerable. Verify your kernel build configuration and applicable vendor advisories to determine which specific kernel versions in your deployment contain this defect.

Exploitability

Exploitation requires local network access to transmit crafted MRP protocol frames to the target system. The vulnerability cannot be exploited remotely across untrusted networks. An attacker with network-layer access to a VLAN where MRP is active can send malformed MRP PDUs to trigger the parsing defect. The attack does not require elevated privileges on the target system—the kernel processes MRP frames at the network stack level regardless of user privilege. No user interaction is required; exploitation is fully automated once a crafted frame is transmitted. The lack of CVSS vector components for attack complexity (AC:L) and privileges required (PR:L) reflects that while local presence is needed, the vulnerability is trivial to trigger once that access exists.

Remediation

Apply the fix to mrp_pdu_parse_vecattr() by updating to a patched Linux kernel release. Verify against the official Linux kernel security advisories and your distribution's security errata for the exact patched version numbers for your release series. As a temporary mitigation, disable Media Redundancy Protocol if it is not operationally necessary by unloading the MRP module or recompiling the kernel without MRP support. Ensure network segmentation prevents untrusted hosts from accessing network segments where MRP is active; this limits the attack surface to trusted internal networks.

Patch guidance

Contact your Linux distribution (Red Hat, Ubuntu, Debian, SUSE, etc.) or your hardware vendor (if using embedded Linux) for patched kernel releases addressing CVE-2026-53245. Verify the patch against the upstream Linux kernel mailing list and kernel.org security announcements to confirm the fix version. Apply patches according to your standard kernel update procedures, which typically involve testing in a staging environment before production deployment. MRP is not universally enabled in all kernel builds; confirm that your affected systems have MRP support compiled in before prioritizing patches for those systems.

Detection guidance

Kernel log analysis: monitor dmesg and systemd journal for MRP-related errors, kernel warnings, or panics coinciding with MRP traffic. Anomalies include 'MRP applicant' state machine errors or unexpected stack traces referencing mrp_pdu_parse_vecattr. Network behavior: monitor network interfaces configured with MRP for unexpected topology changes, redundancy group failures, or repeated failovers that may indicate corrupted state. Systems without MRP active will not generate MRP-specific logs; focus detection on production environments known to use MRP. Intrusion detection: network-based IDS signatures can detect malformed MRP frames with invalid vector attribute structures, though custom signatures may be required as MRP is not universally monitored.

Why prioritize this

Although the CVSS score is moderate (5.5), prioritization depends on your environment's reliance on MRP. Organizations deploying Media Redundancy Protocol for critical network failover (industrial control systems, automotive, carrier networks) should prioritize patching immediately, as availability impact during an outage can exceed the moderate numerical score. Organizations without MRP enabled can defer this patch to standard maintenance windows. The local-access requirement significantly reduces exploitation likelihood compared to remote vulnerabilities, but the trivial trigger mechanism (sending a crafted frame) and lack of exploitability barriers once network access is gained justify prompt remediation in MRP-active environments.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium severity) reflects: (1) Attack Vector: Local—requires network-layer access to the same network segment where MRP is active, not exploitable from the internet; (2) Attack Complexity: Low—once network access exists, crafting a malicious MRP frame is trivial; (3) Privileges Required: Low—the attack targets kernel networking code, which processes frames regardless of user privilege; (4) User Interaction: None; (5) Scope: Unchanged—impact is confined to the MRP protocol handler; (6) Confidentiality, Integrity: None—no data exfiltration or code execution; (7) Availability: High—denial of service via kernel panic, state corruption, or failover failure. The score appropriately reflects a medium-risk availability defect without escalation paths, but organizations heavily dependent on MRP should treat this as higher priority than the base score suggests.

Frequently asked questions