Linux KernelOperating system · Linux
CVE-2026-53131
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedIn the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe Linux kernel's netfilter subsystem has a memory safety vulnerability where multiple components (ip6t_eui64, xt_mac, various ipset types, and nf_log_syslog) access the Ethernet header via eth_hdr(skb) without properly validating that the skb is associated with an Ethernet device, has a valid MAC header set, and contains at least ETH_HLEN (14) bytes. This can lead to out-of-bounds memory access when processing non-Ethernet network packets.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Linux KernelOperating system
>= 2.6.12.1, < 5.15.210>= 5.16, < 6.1.176>= 6.2, < 6.6.143>= 6.7, < 6.12.94>= 6.13, < 6.18.36>= 6.19, < 7.0.13= 2.6.12CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- Low
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Determine the running kernel versionRun `uname -r` or `cat /proc/version` to obtain the kernel version stringAffected if The kernel version falls within any of these ranges: >= 2.6.12.1 and < 5.15.210; >= 5.16 and < 6.1.176; >= 6.2 and < 6.6.143; >= 6.7 and < 6.12.94; >= 6.13 and < 6.18.36; >= 6.19 and < 7.0.13; or equals exactly 2.6.12
-
Identify if the ip6t_eui64 netfilter module is loaded or in useRun `lsmod | grep eui64` to check if the module is loaded, and run `ip6tables -L -n -v 2>/dev/null | grep eui64` or check /proc/net/ip6_tables_names for ip6tables involvementAffected if The module is loaded or any ip6tables rule references the eui64 match target on a system with a vulnerable kernel version
-
Identify if the xt_mac netfilter module is loaded or in useRun `lsmod | grep xt_mac` to check if the module is loaded, and run `iptables -L -n -v 2>/dev/null | grep mac` or check /proc/net/ip_tables_names for iptables involvementAffected if The xt_mac module is loaded or any iptables rule uses the mac match on a system with a vulnerable kernel version
-
Identify if nf_log_syslog netfilter component is in useCheck if nf_log_syslog is loaded via `lsmod | grep nf_log` and inspect netfilter logging configuration via `cat /proc/net/netfilter/nf_log`Affected if Syslog logging is enabled for netfilter (NF_LOG_TYPE的社会 version logging) on a system with a vulnerable kernel version
-
Identify if ipset with ethernet header-dependent types is in useRun `ipset list` to list active ipset sets and examine whether any sets use types that rely on Ethernet header access (such as hash:mac), then check if ipset is actively used in iptables rules via `iptables -L -n | grep -i set`Affected if Ip sets using hash:mac or similar Ethernet-header-dependent types exist and are actively used in firewall rules on a system with a vulnerable kernel version
A system is affected if it runs a vulnerable kernel version AND uses any of the affected netfilter components (ip6t_eui64, xt_mac, nf_log_syslog, or ipset types that access Ethernet headers).
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped5.15.2106.1.1766.6.143
Apply the kernel patch that adds proper validation checks (ensuring skb->dev is an Ethernet device, MAC header is set, and spans >= ETH_HLEN) before calling eth_hdr() in the affected netfilter components.
Upgrade to one of: 5.15.210+, 6.1.176+, 6.6.143+, 6.12.94+, or latest stable kernel (preferably 6.12.x or newer)
- 1. Identify the currently running Linux kernel version using `uname -r`
- 2. Determine which version branch your kernel belongs to (e.g., 5.15.x, 6.1.x, 6.2.x, 6.7.x)
- 3. For kernels in the 5.15.x branch: upgrade to kernel version 5.15.210 or later
- 4. For kernels in the 6.1.x branch: upgrade to kernel version 6.1.176 or later
- 5. For kernels in the 6.2.x branch: upgrade to kernel version 6.6.143 or later
- 6. For kernels in the 6.7.x branch: upgrade to kernel version 6.12.94 or later
- 7. Alternatively, upgrade to the latest stable kernel available (e.g., 6.12.x or newer stable branch)
- 8. After kernel upgrade, reboot the system to load the patched kernel
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Linux Kernel
Scoped from the published advisory
- Consultation2.0 h
- Implementation6.0 h
- Testing8.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,440.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-53131 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-53131 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data