CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF
In the Linux kernel, the following vulnerability has been resolved:
macvlan: fix macvlangetsize() not reserving space for IFLAMACVLANBCCUTOFF
macvlangetsize() does not account for IFLAMACVLANBCCUTOFF, but macvlanfillinfo() conditionally includes it when port->bccutoff != 1. This causes nlaputs32() to fail with -EMSGSIZE when the netlink skb runs out of space, triggering a WARNON in rtnetlink and preventing the interface from being dumped.
The bug can be reproduced with:
ip link add macvlan0 link eth0 type macvlan mode bridge ip link set macvlan0 type macvlan bccutoff 0 ip -d link show macvlan0 # fails with -EMSGSIZE
The bccutoff feature was added in commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff"), which added the nlaputs32() call in macvlanfillinfo() but missed adding the corresponding nlatotalsize(4) in macvlangetsize(). A follow-up commit 55cef78c244d ("macvlan: add forgotten nlapolicy for IFLAMACVLANBCCUTOFF") fixed the missing nlapolicy entry but still did not fix the size calculation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
Linux kernel macvlanto a version that resolves this vulnerability.Fixed in 954d1fa1ac93
Event History
Frequently Asked Questions
What configuration is required to trigger the issue?
A macvlan interface must have its broadcast cutoff set to a value other than 1, such as 0. The failure is triggered when its details are dumped through rtnetlink, for example with "ip -d link show macvlan0".
What is the operational impact?
The netlink message can run out of reserved space when adding the broadcast cutoff attribute, causing nla_put_s32() to return -EMSGSIZE. This triggers a WARN_ON in rtnetlink and prevents the affected macvlan interface from being dumped.
Who can trigger the problem?
The supplied vector indicates local access with low privileges and no user interaction. Exploitation requires the ability to create or configure a macvlan interface and set its bc_cutoff value.