CVE-2026-53245 - Vulnerability Details

- net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

Description

In the Linux kernel, the following vulnerability has been resolved:

net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

In mrp_pdu_parse_vecattr(), vector attribute events are encoded three
per byte and valen tracks the number of events left to process.

The parser decrements valen after processing the first and second events
from each event byte, but not after processing the third one. When valen
is exactly a multiple of three, the loop continues after the last valid
event and consumes the next byte as a new event byte, applying a
spurious event to the MRP applicant state.

Additionally, when valen is zero the parser unconditionally consumes
attrlen bytes as FirstValue and advances the offset, even though per
IEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of
zero and no FirstValue or Vector fields. This corrupts the offset for
subsequent PDU parsing.

Also, when valen exceeds three the loop crosses byte boundaries but
the attribute value is not incremented between the last event of one
byte and the first event of the next. This causes the first event of
the next byte to use the same attribute value as the third event
rather than the next consecutive value.

Decrement valen after processing the third event, skip FirstValue
consumption when valen is zero, and increment the attribute value at
the end of each loop iteration.

Published: 2026-06-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug in mrp_pdu_parse_vecattr in the Linux kernel's net/802/mrp subsystem causes the parser to incorrectly decrement the event counter, consume erroneous packet bytes, and mishandle empty vector attributes. This results in spurious MRP events being applied and incorrect offset calculations for subsequent PDUs. The flaw represents a buffer manipulation weakness (CWE-1285) and could corrupt kernel data structures that control MRP state, potentially leading to memory corruption and a crash.

Affected Systems

All Linux kernel implementations that include the IEEE 802.1ak MRP code compiled into the kernel when MRP is enabled. This includes every standard Linux distribution running a native kernel, as no specific kernel version range is listed in the advisory. The issue exists in the net/802/mrp code compiled into the kernel when MRP is enabled.

Risk and Exploitability

The CVSS score of 5.5 indicates medium severity. The EPSS score (< 1%) and absence from the CISA KEV catalog suggest a low probability of exploitation, but a malicious actor could target a host on a network segment that participates in MRP by sending malformed MRP PDUs. Based on the description, it is inferred that an attacker would need network proximity or control of a VLAN that exchanges MRP frames to trigger the defect and cause kernel.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`febf018d22347b5df94066bca05d0c11a84e839d`	affected	< ae65714d96f68bb252eb20085320bdaacab36c00
`febf018d22347b5df94066bca05d0c11a84e839d`	affected	< 36d259711872e3b2f6cd76a4d270c21931c0f35f
`febf018d22347b5df94066bca05d0c11a84e839d`	affected	< cc98717e591a963a616fdf15ecf48eefaf45d758
`febf018d22347b5df94066bca05d0c11a84e839d`	affected	< 6d6e42e8e17f18d61327f8653479c5b5e161ae1d
`febf018d22347b5df94066bca05d0c11a84e839d`	affected	< fd9c3a47c670bec6b18f44454cea023f93b5adb3
`febf018d22347b5df94066bca05d0c11a84e839d`	affected	< 42446ca0f3570663e87183c065e0b4def52dfba2
`febf018d22347b5df94066bca05d0c11a84e839d`	affected	< 6eea6494e542a03cdf755a593b7d74f3f7c260fd
`febf018d22347b5df94066bca05d0c11a84e839d`	affected	< 7561c7fbc694308da73300f036719e63e42bf0b4

Linux

affected

Version	Status	Constraints
`3.9`	affected	—
`0`	unaffected	< 3.9
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[febf018d22347b5df94066bca05d0c11a84e839d,ae65714d96f68bb252eb20085320bdaacab36c00)`	affected	code_commit	—
`[febf018d22347b5df94066bca05d0c11a84e839d,36d259711872e3b2f6cd76a4d270c21931c0f35f)`	affected	code_commit	—
`[febf018d22347b5df94066bca05d0c11a84e839d,cc98717e591a963a616fdf15ecf48eefaf45d758)`	affected	code_commit	—
`[febf018d22347b5df94066bca05d0c11a84e839d,6d6e42e8e17f18d61327f8653479c5b5e161ae1d)`	affected	code_commit	—
`[febf018d22347b5df94066bca05d0c11a84e839d,fd9c3a47c670bec6b18f44454cea023f93b5adb3)`	affected	code_commit	—
`[febf018d22347b5df94066bca05d0c11a84e839d,42446ca0f3570663e87183c065e0b4def52dfba2)`	affected	code_commit	—
`[febf018d22347b5df94066bca05d0c11a84e839d,6eea6494e542a03cdf755a593b7d74f3f7c260fd)`	affected	code_commit	—
`[febf018d22347b5df94066bca05d0c11a84e839d,7561c7fbc694308da73300f036719e63e42bf0b4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.9`	affected	generic	—
`[0,3.9)`	unaffected	generic	—
`[5.10.259,5.10.*]`	unaffected	generic	—
`[5.15.210,5.15.*]`	unaffected	generic	—
`[6.1.176,6.1.*]`	unaffected	generic	—
`[6.6.143,6.6.*]`	unaffected	generic	—
`[6.12.94,6.12.*]`	unaffected	generic	—
`[6.18.36,6.18.*]`	unaffected	generic	—
`[7.0.13,7.0.*]`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the net attribute parsing fix (e.g., the commit referenced in the advisory).
If a kernel upgrade is not immediately feasible, disable MRP processing on affected interfaces to prevent malformed MRP PDUs from being parsed.
Restrict MRP traffic to trusted hosts by isolating or VLAN‑segmenting the network segments that carry MRP control frames, thereby limiting exposure to potential attackers.

Generated by OpenCVE AI on June 26, 2026 at 17:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00128.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/36d259711872e3b2f6cd76a4d270c21931c0f35f
https://git.kernel.org/stable/c/42446ca0f3570663e87183c065e0b4def52dfba2
https://git.kernel.org/stable/c/6d6e42e8e17f18d61327f8653479c5b5e161ae1d
https://git.kernel.org/stable/c/6eea6494e542a03cdf755a593b7d74f3f7c260fd
https://git.kernel.org/stable/c/7561c7fbc694308da73300f036719e63e42bf0b4
https://git.kernel.org/stable/c/ae65714d96f68bb252eb20085320bdaacab36c00
https://git.kernel.org/stable/c/cc98717e591a963a616fdf15ecf48eefaf45d758
https://git.kernel.org/stable/c/fd9c3a47c670bec6b18f44454cea023f93b5adb3
https://lore.kernel.org/linux-cve-announce/2026062512-CVE-2026-53245-2838@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53245
https://www.cve.org/CVERecord?id=CVE-2026-53245

History

Fri, 26 Jun 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122 CWE-754

Fri, 26 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1285
References		https://lore.kernel.org/linux-cve-announce/2026062512-CVE-2026-53245-2838@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53245 https://www.cve.org/CVERecord?id=CVE-2026-53245
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 25 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122 CWE-754

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr In mrp_pdu_parse_vecattr(), vector attribute events are encoded three per byte and valen tracks the number of events left to process. The parser decrements valen after processing the first and second events from each event byte, but not after processing the third one. When valen is exactly a multiple of three, the loop continues after the last valid event and consumes the next byte as a new event byte, applying a spurious event to the MRP applicant state. Additionally, when valen is zero the parser unconditionally consumes attrlen bytes as FirstValue and advances the offset, even though per IEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of zero and no FirstValue or Vector fields. This corrupts the offset for subsequent PDU parsing. Also, when valen exceeds three the loop crosses byte boundaries but the attribute value is not incremented between the last event of one byte and the first event of the next. This causes the first event of the next byte to use the same attribute value as the third event rather than the next consecutive value. Decrement valen after processing the third event, skip FirstValue consumption when valen is zero, and increment the attribute value at the end of each loop iteration.
Title		net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/36d259711872e3b2f6cd76a4d270c21931c0f35f https://git.kernel.org/stable/c/42446ca0f3570663e87183c065e0b4def52dfba2 https://git.kernel.org/stable/c/6d6e42e8e17f18d61327f8653479c5b5e161ae1d https://git.kernel.org/stable/c/6eea6494e542a03cdf755a593b7d74f3f7c260fd https://git.kernel.org/stable/c/7561c7fbc694308da73300f036719e63e42bf0b4 https://git.kernel.org/stable/c/ae65714d96f68bb252eb20085320bdaacab36c00 https://git.kernel.org/stable/c/cc98717e591a963a616fdf15ecf48eefaf45d758 https://git.kernel.org/stable/c/fd9c3a47c670bec6b18f44454cea023f93b5adb3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:39.108Z

Updated: 2026-06-25T08:39:39.108Z

Reserved: 2026-06-09T07:44:35.393Z

Link: CVE-2026-53245

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53245 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-26T17:30:05Z

Weaknesses

CWE-1285
Improper Validation of Specified Index, Position, or Offset in Input

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object