CVE-2026-53014

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir<br /> <br /> In tcf_blockcast_redir(), when iterating block ports to redirect<br /> packets to multiple devices, the mac_header_xmit flag is queried<br /> from the wrong device. The loop sends to dev_prev but queries<br /> dev_is_mac_header_xmit(dev) — which is the NEXT device in the<br /> iteration, not the one being sent to.<br /> <br /> This causes tcf_mirred_to_dev() to make incorrect decisions about<br /> whether to push or pull the MAC header. When the block contains<br /> mixed device types (e.g., an ethernet veth and a tunnel device),<br /> intermediate devices get the wrong mac_header_xmit flag, leading to<br /> skb header corruption. In the worst case, skb_push_rcsum with an<br /> incorrect mac_len can exhaust headroom and panic.<br /> <br /> The last device in the loop is handled correctly (line 365-366 uses<br /> dev_is_mac_header_xmit(dev_prev)), confirming this is a copy-paste<br /> oversight for the intermediate devices.<br /> <br /> Fix by using dev_prev instead of dev for the mac_header_xmit query,<br /> consistent with the device actually being sent to.