VulnerabilityPublished 24 Jun 2026Updated 6 Nov 2026

CVE-2026-53013: Linux kernel · macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in fa92a77b0ed4d5f11a71665a232ac5a54a4b055d : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:34 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in fa92a77b0ed4d5f11a71665a232ac5a54a4b055d, b6b7154e9f5d75b608ceb2d05b376de8c638c40e, 4979252758387b338ca968ba7e0515b0ae2257e3 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < fa92a77b0ed4d5f11a71665a232ac5a54a4b055d	Fixed in fa92a77b0ed4d5f11a71665a232ac5a54a4b055d
LinuxLinux	Affected ≥ 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < b6b7154e9f5d75b608ceb2d05b376de8c638c40e	Fixed in b6b7154e9f5d75b608ceb2d05b376de8c638c40e
LinuxLinux	Affected ≥ 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < 4979252758387b338ca968ba7e0515b0ae2257e3	Fixed in 4979252758387b338ca968ba7e0515b0ae2257e3
LinuxLinux	Affected ≥ 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < 77ecfa4e27f282d224215895ddfbeb916fc75e24	Fixed in 77ecfa4e27f282d224215895ddfbeb916fc75e24
LinuxLinux	Affected ≥ 954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348, < 1c004f14ccdc11585625c168bb9a7c5e1b8afb0c	Fixed in 1c004f14ccdc11585625c168bb9a7c5e1b8afb0c
LinuxLinux	Affected =6.4	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF macvlan_get_size() does not account for IFLA_MACVLAN_BC_CUTOFF, but macvlan_fill_info() conditionally includes it when port->bc_cutoff != 1. This causes nla_put_s32() to fail with -EMSGSIZE when the netlink skb runs out of space, triggering a WARN_ON in rtnetlink and preventing the interface from being dumped. The bug can be reproduced with: ip link add macvlan0 link eth0 type macvlan mode bridge ip link set macvlan0 type macvlan bc_cutoff 0 ip -d link show macvlan0 # fails with -EMSGSIZE The bc_cutoff feature was added in commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff"), which added the nla_put_s32() call in macvlan_fill_info() but missed adding the corresponding nla_total_size(4) in macvlan_get_size(). A follow-up commit 55cef78c244d ("macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF") fixed the missing nla_policy entry but still did not fix the size calculation.

References

Community reviews

Loading reviews…