CVE-2026-53245

Analyzed Analyzed - Analysis Complete

Memory Corruption in Linux Kernel MRP Parser

Publication date: 2026-06-25

Last updated on: 2026-07-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr In mrp_pdu_parse_vecattr(), vector attribute events are encoded three per byte and valen tracks the number of events left to process. The parser decrements valen after processing the first and second events from each event byte, but not after processing the third one. When valen is exactly a multiple of three, the loop continues after the last valid event and consumes the next byte as a new event byte, applying a spurious event to the MRP applicant state. Additionally, when valen is zero the parser unconditionally consumes attrlen bytes as FirstValue and advances the offset, even though per IEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of zero and no FirstValue or Vector fields. This corrupts the offset for subsequent PDU parsing. Also, when valen exceeds three the loop crosses byte boundaries but the attribute value is not incremented between the last event of one byte and the first event of the next. This causes the first event of the next byte to use the same attribute value as the third event rather than the next consecutive value. Decrement valen after processing the third event, skip FirstValue consumption when valen is zero, and increment the attribute value at the end of each loop iteration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-07

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53245

EUVD

EUVD-2026-39196

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 3.9 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's handling of vector attribute parsing within the mrp_pdu_parse_vecattr() function. The function processes events encoded three per byte, tracked by a counter called valen. Due to incorrect decrementing of valen and improper handling of certain conditions, the parser can consume extra bytes as events incorrectly, apply spurious events to the MRP applicant state, and corrupt the parsing offset for subsequent data. Specifically, valen is not decremented after the third event, causing the loop to continue improperly; the parser consumes FirstValue bytes even when valen is zero, which is against the IEEE 802.1ak standard; and the attribute value is not incremented correctly between bytes, causing event values to be reused incorrectly.

Impact Analysis

This vulnerability can lead to incorrect parsing of MRP (Multiple Registration Protocol) data units in the Linux kernel, which may cause the MRP applicant state to be corrupted by spurious events. This could result in unexpected behavior in network protocols relying on MRP, potentially causing network instability or incorrect network state management.

Mitigation Strategies

The vulnerability is resolved by fixing the vector attribute parsing in the Linux kernel's mrp_pdu_parse_vecattr function. Immediate mitigation involves updating the Linux kernel to a version where this fix is applied.

Specifically, the fix includes decrementing valen after processing the third event, skipping FirstValue consumption when valen is zero, and incrementing the attribute value at the end of each loop iteration to prevent parsing errors and state corruption.

Hi! I’m here to help you understand CVE-2026-53245. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70