Linux Kernel: Netlabel Address Attribute Vulnerability

CVE-2026-53238

What is CVE-2026-53238?

A vulnerability exists in the Linux kernel's netlabel functionality due to inadequate validation of address and mask attribute lengths. The function netlbl_unlabel_addrinfo_get() relies on the length of the address attribute for processing IP addresses but fails to independently verify the corresponding mask attribute length. This oversight could allow an attacker to send a malicious Generic Netlink request that includes a valid IP address attribute but with a shorter mask attribute. As a result, the system may incorrectly interpret these shortened mask attributes, leading to potential security risks.

References