CVE-2026-53238 is a vulnerability in Linux Kernel
Published on June 25, 2026
netlabel: validate unlabeled address and mask attribute lengths
In the Linux kernel, the following vulnerability has been resolved:
netlabel: validate unlabeled address and mask attribute lengths
netlbl_unlabel_addrinfo_get() used the address attribute length to
determine whether the attribute data could be read as an IPv4 or IPv6
address, but did not independently validate the corresponding mask
attribute length. A crafted Generic Netlink request could therefore
provide a valid IPv4/IPv6 address attribute with a shorter mask
attribute, which would later be read as a full struct in_addr or
struct in6_addr.
NLA_BINARY policy lengths are maximum lengths by default, so use
NLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask
attributes. This rejects short attributes during policy validation and
also exposes the exact length requirements through policy introspection.
Products Associated with CVE-2026-53238
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd and below 975a84fd741440853380d37465b6e226cf47254c is affected.
- Version 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd and below 672f0f3b8f875ffe6525a37847eafa7648c4c0c6 is affected.
- Version 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd and below 95bda3eac0b1454c2cee98d58d9ba6dd8391e843 is affected.
- Version 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd and below 07a18f5c90dd3d586b73242f5a5bbf0a72f2fdc6 is affected.
- Version 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd and below 71c52da13c3737493b42d20d9f33de34e03b3156 is affected.
- Version 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd and below 0c4bb32ad7fdc2dc6a8050f41eb04d4bda56b6c8 is affected.
- Version 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd and below ccfe292a966079c61ea68a2da303b2a336170993 is affected.
- Version 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd and below 9772589b57e44aedc240211c5c3f7a684a034d3a is affected.
- Version 2.6.25 is affected.
- Before 2.6.25 is unaffected.
- Version 5.10.259, <= 5.10.* is unaffected.
- Version 5.15.210, <= 5.15.* is unaffected.
- Version 6.1.176, <= 6.1.* is unaffected.
- Version 6.6.143, <= 6.6.* is unaffected.
- Version 6.12.94, <= 6.12.* is unaffected.
- Version 6.18.36, <= 6.18.* is unaffected.
- Version 7.0.13, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.