CVE-2026-53001: netfilter: xtables: restrict several matches to inet family
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtables: restrict several matches to inet family
This is a partial revert of:
commit ab4f21e6fb1c ("netfilter: xtables: use NFPROTOUNSPEC in more extensions")
to allow ipv4 and ipv6 only.
- xtmac - xtowner - xtphysdev
These extensions are not used by ebtables in userspace.
Moreover, xtrealm is only for ipv4, since dst->tclassid is ipv4 specific.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Exposure is limited to Linux kernel systems using netfilter/xtables rules with the affected match extensions: xt_mac, xt_owner, xt_physdev, or xt_realm. The issue requires local, low-privileged access according to the supplied CVSS vector.
Are all protocol families intended to use these matches?
No. xt_mac, xt_owner, and xt_physdev are intended to be restricted to IPv4 and IPv6, while xt_realm is IPv4-only because it relies on an IPv4-specific dst->tclassid field. These extensions are not used by ebtables in userspace.
What should be done to remediate the issue?
Apply an available Linux kernel patch. The referenced stable commits provide the remediation.