CVE-2026-52942
netfilter: nf_log: validate MAC header was set before dumping it
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log. This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed). Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before. BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265)
INFO
Published Date :
June 24, 2026, 8:16 a.m.
Last Modified :
July 8, 2026, 7:08 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Apply kernel patches for netfilter: nf_log.
- Update the Linux kernel.
- Validate MAC header before dumping.
- Check skb_mac_header_was_set() correctly.
Public PoC/Exploit Available at Github
CVE-2026-52942 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-52942.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-52942 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-52942
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-52942 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-52942 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CWE CWE-125 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.176 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.36 up to (excluding) 5.15.210 Added Reference Type kernel.org: https://git.kernel.org/stable/c/65ef7397eb9a296e91839f5fd10be96f23d332e7 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8a81e336da685423f5b64aac4d571e63d674c52a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a84b6fedbc97078788be78dbdd7517d143ad1a77 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/af1b7699466f6556b351fa25d3dc870abfb5d310 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/befb8968a2abdfa948d5600ea7f7a509a292a590 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c38d41134085193efd5b237cf513ad5b3421a60d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d704ee9c7bc68a161684c51a7ac05b446dcf38d4 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '7eb9282cd0efac08b8377cbd5037ba297c77e3f7', 'lessThan': 'd704ee9c7bc68a161684c51a7ac05b446dcf38d4', 'versionType': 'git'}, {'status': 'affected', 'version': '7eb9282cd0efac08b8377cbd5037ba297c77e3f7', 'lessThan': 'befb8968a2abdfa948d5600ea7f7a509a292a590', 'versionType': 'git'}, {'status': 'affected', 'version': '7eb9282cd0efac08b8377cbd5037ba297c77e3f7', 'lessThan': '8a81e336da685423f5b64aac4d571e63d674c52a', 'versionType': 'git'}, {'status': 'affected', 'version': '7eb9282cd0efac08b8377cbd5037ba297c77e3f7', 'lessThan': 'c38d41134085193efd5b237cf513ad5b3421a60d', 'versionType': 'git'}, {'status': 'affected', 'version': '7eb9282cd0efac08b8377cbd5037ba297c77e3f7', 'lessThan': 'af1b7699466f6556b351fa25d3dc870abfb5d310', 'versionType': 'git'}, {'status': 'affected', 'version': '7eb9282cd0efac08b8377cbd5037ba297c77e3f7', 'lessThan': '65ef7397eb9a296e91839f5fd10be96f23d332e7', 'versionType': 'git'}, {'status': 'affected', 'version': '7eb9282cd0efac08b8377cbd5037ba297c77e3f7', 'lessThan': 'a84b6fedbc97078788be78dbdd7517d143ad1a77', 'versionType': 'git'}], 'programFiles': ['net/netfilter/nf_log_syslog.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.36'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.36', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/netfilter/nf_log_syslog.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log. This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed). Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before. BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265) Added Reference https://git.kernel.org/stable/c/65ef7397eb9a296e91839f5fd10be96f23d332e7 Added Reference https://git.kernel.org/stable/c/8a81e336da685423f5b64aac4d571e63d674c52a Added Reference https://git.kernel.org/stable/c/a84b6fedbc97078788be78dbdd7517d143ad1a77 Added Reference https://git.kernel.org/stable/c/af1b7699466f6556b351fa25d3dc870abfb5d310 Added Reference https://git.kernel.org/stable/c/befb8968a2abdfa948d5600ea7f7a509a292a590 Added Reference https://git.kernel.org/stable/c/c38d41134085193efd5b237cf513ad5b3421a60d Added Reference https://git.kernel.org/stable/c/d704ee9c7bc68a161684c51a7ac05b446dcf38d4