[SRU][Q/J][PATCH 0/2] CVE-2026-53131

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53131

[ Impact ]

Several netfilter and ipset components access the Ethernet header via
eth_hdr(skb) after only assuming the skb is associated with an Ethernet device
or checking that ETH_HLEN bytes lie within the skb. Affected paths include
ip6t_eui64, xt_mac, the bitmap:ip,mac, hash:ip,mac, and hash:mac ipset types,
and nf_log_syslog. This can lead to reads of the MAC header when it was never
set or does not span a full Ethernet header, resulting in out-of-bounds access.

[ Fix ]

questing: clean cherry-pick
jammy: clean cherry-pick
focal: backported with AI-assisted adaptation
bionic: backported with AI-assisted adaptation
xenial: backported with AI-assisted adaptation
trusty: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

An incorrect fix could reject or mishandle legitimate packets in the
netfilter/ipset paths, causing dropped traffic or ruleset matching failures for
MAC-based rules. Regressions would be confined to the netfilter and ipset
subsystems.