{"id":"CVE-2026-53238","title":"netlabel: validate unlabeled address and mask attribute lengths","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetlabel: validate unlabeled address and mask attribute lengths\n\nnetlbl_unlabel_addrinfo_get() used the address attribute length to\ndetermine whether the attribute data…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 975a84fd741440853380d37465b6e226cf47254c","Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 672f0f3b8f875ffe6525a37847eafa7648c4c0c6","Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 95bda3eac0b1454c2cee98d58d9ba6dd8391e843","Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 07a18f5c90dd3d586b73242f5a5bbf0a72f2fdc6","Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 71c52da13c3737493b42d20d9f33de34e03b3156","Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 0c4bb32ad7fdc2dc6a8050f41eb04d4bda56b6c8","Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < ccfe292a966079c61ea68a2da303b2a336170993","Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 9772589b57e44aedc240211c5c3f7a684a034d3a","Linux 2.6.25"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:23:30.513801Z"},"published":"2026-06-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:24:08.569Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53238","references":[{"url":"https://git.kernel.org/stable/c/975a84fd741440853380d37465b6e226cf47254c"},{"url":"https://git.kernel.org/stable/c/672f0f3b8f875ffe6525a37847eafa7648c4c0c6"},{"url":"https://git.kernel.org/stable/c/95bda3eac0b1454c2cee98d58d9ba6dd8391e843"},{"url":"https://git.kernel.org/stable/c/07a18f5c90dd3d586b73242f5a5bbf0a72f2fdc6"},{"url":"https://git.kernel.org/stable/c/71c52da13c3737493b42d20d9f33de34e03b3156"},{"url":"https://git.kernel.org/stable/c/0c4bb32ad7fdc2dc6a8050f41eb04d4bda56b6c8"},{"url":"https://git.kernel.org/stable/c/ccfe292a966079c61ea68a2da303b2a336170993"},{"url":"https://git.kernel.org/stable/c/9772589b57e44aedc240211c5c3f7a684a034d3a"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02026,"ingestedAt":"2026-11-06T16:57:43.268Z","slug":"CVE-2026-53238","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetlabel: validate unlabeled address and mask attribute lengths\n\nnetlbl_unlabel_addrinfo_get() used the address attribute length to\ndetermine whether the attribute data could be read as an IPv4 or IPv6\naddress, but did not independently validate the corresponding mask\nattribute length.  A crafted Generic Netlink request could therefore\nprovide a valid IPv4/IPv6 address attribute with a shorter mask\nattribute, which would later be read as a full struct in_addr or\nstruct in6_addr.\n\nNLA_BINARY policy lengths are maximum lengths by default, so use\nNLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask\nattributes.  This rejects short attributes during policy validation and\nalso exposes the exact length requirements through policy introspection.\n\n## Affected\n\n- `Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 975a84fd741440853380d37465b6e226cf47254c`\n- `Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 672f0f3b8f875ffe6525a37847eafa7648c4c0c6`\n- `Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 95bda3eac0b1454c2cee98d58d9ba6dd8391e843`\n- `Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 07a18f5c90dd3d586b73242f5a5bbf0a72f2fdc6`\n- `Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 71c52da13c3737493b42d20d9f33de34e03b3156`\n- `Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 0c4bb32ad7fdc2dc6a8050f41eb04d4bda56b6c8`\n- `Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < ccfe292a966079c61ea68a2da303b2a336170993`\n- `Linux >= 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd < 9772589b57e44aedc240211c5c3f7a684a034d3a`\n- `Linux 2.6.25`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}