High 7.1Published Jun 24, 2026

CVE-2026-52942netfilter: nf_log: validate MAC header was set before dumping it

Updated under an hour ago (Oct 28, 2026, 3:10 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log. This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed). Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before. BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265)

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	7eb9282cd0efac08b8377cbd5037ba297c77e3f7 builds before 2e96e1bc9b4d5450e6c33f078e19a9bc1dda6c0b; from 7eb9282cd0efac08b8377cbd5037ba297c77e3f7 before d704ee9c7bc68a161684c51a7ac05b446dcf38d4; from 7eb9282cd0efac08b8377cbd5037ba297c77e3f7 before befb8968a2abdfa948d5600ea7f7a509a292a590; from 7eb9282cd0efac08b8377cbd5037ba297c77e3f7 before 8a81e336da685423f5b64aac4d571e63d674c52a; from 7eb9282cd0efac08b8377cbd5037ba297c77e3f7 before c38d41134085193efd5b237cf513ad5b3421a60d; from 7eb9282cd0efac08b8377cbd5037ba297c77e3f7 before af1b7699466f6556b351fa25d3dc870abfb5d310; from 7eb9282cd0efac08b8377cbd5037ba297c77e3f7 before 65ef7397eb9a296e91839f5fd10be96f23d332e7; from 7eb9282cd0efac08b8377cbd5037ba297c77e3f7 before a84b6fedbc97078788be78dbdd7517d143ad1a77	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.36 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; 7.1; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/2e96e1bc9b4d5450e6c33f078e19a9bc1dda6c0b
https://git.kernel.org/stable/c/d704ee9c7bc68a161684c51a7ac05b446dcf38d4	patch
https://git.kernel.org/stable/c/befb8968a2abdfa948d5600ea7f7a509a292a590	patch
https://git.kernel.org/stable/c/8a81e336da685423f5b64aac4d571e63d674c52a	patch
https://git.kernel.org/stable/c/c38d41134085193efd5b237cf513ad5b3421a60d	patch
https://git.kernel.org/stable/c/af1b7699466f6556b351fa25d3dc870abfb5d310	patch
https://git.kernel.org/stable/c/65ef7397eb9a296e91839f5fd10be96f23d332e7	patch
https://git.kernel.org/stable/c/a84b6fedbc97078788be78dbdd7517d143ad1a77	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.