CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr()

Synopsis

An out-of-bounds memory access vulnerability exists in the Linux kernel's netfilter subsystem, affecting several components including ip6t_eui64, xt_mac, multiple ipset types (bitmap:ip,mac, hash:ip,mac, hash:mac), and nf_log_syslog. The flaw is reachable over the network without any authentication, because maliciously crafted network packets can trigger the vulnerable code paths in kernel space. Successful exploitation gives an attacker the ability to read sensitive kernel memory, partially modify data, and crash the affected system. A patched-image rebuild at the fix versions is available on HarborGuard for environments running an affected kernel.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send packets to the target system over the network; the vulnerable netfilter paths are reachable via crafted network traffic without requiring any local presence on the host.

• AuthenticationNot required

  No credentials or account are needed; the vulnerable code paths can be reached by any unauthenticated network sender.

• Victim interactionNot required

  No user action is required; the kernel processes incoming packets automatically, triggering the vulnerable path without any human on the target system needing to do anything.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race timing, or memory-layout knowledge to trigger.

Blast Radius

• An attacker can read kernel memory contents, exposing data such as cryptographic material, session state, or other in-kernel buffers.
• An attacker can partially overwrite kernel data, allowing limited tampering with packet-processing state or netfilter rule outcomes.
• An attacker can crash the kernel by triggering the out-of-bounds access, causing a full system reboot and denial of service for all workloads on that host.
• Any container sharing the host kernel is affected equally, so a single crafted packet stream can impact multiple co-located workloads simultaneously.