CVE-2026-53245

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr<br /> <br /> In mrp_pdu_parse_vecattr(), vector attribute events are encoded three<br /> per byte and valen tracks the number of events left to process.<br /> <br /> The parser decrements valen after processing the first and second events<br /> from each event byte, but not after processing the third one. When valen<br /> is exactly a multiple of three, the loop continues after the last valid<br /> event and consumes the next byte as a new event byte, applying a<br /> spurious event to the MRP applicant state.<br /> <br /> Additionally, when valen is zero the parser unconditionally consumes<br /> attrlen bytes as FirstValue and advances the offset, even though per<br /> IEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of<br /> zero and no FirstValue or Vector fields. This corrupts the offset for<br /> subsequent PDU parsing.<br /> <br /> Also, when valen exceeds three the loop crosses byte boundaries but<br /> the attribute value is not incremented between the last event of one<br /> byte and the first event of the next. This causes the first event of<br /> the next byte to use the same attribute value as the third event<br /> rather than the next consecutive value.<br /> <br /> Decrement valen after processing the third event, skip FirstValue<br /> consumption when valen is zero, and increment the attribute value at<br /> the end of each loop iteration.