Netfilter Xtables IPv4/IPv6 Restriction in Linux Kernel

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: restrict several matches to inet family This is a partial revert of: commit ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions") to allow ipv4 and ipv6 only. - xt_mac - xt_owner - xt_physdev These extensions are not used by ebtables in userspace. Moreover, xt_realm is only for ipv4, since dst->tclassid is ipv4 specific.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-53001

EUVD

EUVD-2026-38869

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 2.6.28 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the Linux kernel's netfilter subsystem, specifically the xtables extensions. The issue was that several matches (xt_mac, xt_owner, xt_physdev) were not properly restricted to the inet family (IPv4 and IPv6). The vulnerability was addressed by partially reverting a previous commit to ensure these matches only apply to IPv4 and IPv6 protocols. Additionally, xt_realm is limited to IPv4 only because it relies on an IPv4-specific field.

Impact Analysis

If these xtables matches are not properly restricted to the inet family, it could potentially allow unintended behavior or misconfiguration in firewall rules, possibly affecting network filtering and security policies. This could lead to incorrect packet filtering or bypassing of intended network controls.

Hi! I’m here to help you understand CVE-2026-53001. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70