APPLIED[HWE-6.17/J]/Cmnt: [SRU][Q/J][PATCH 0/2] CVE-2026-53131

[Stefan Bader]

On 17/07/2026 14:03, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53131
> 
> [ Impact ]
> 
> Several netfilter and ipset components access the Ethernet header via
> eth_hdr(skb) after only assuming the skb is associated with an Ethernet device
> or checking that ETH_HLEN bytes lie within the skb. Affected paths include
> ip6t_eui64, xt_mac, the bitmap:ip,mac, hash:ip,mac, and hash:mac ipset types,
> and nf_log_syslog. This can lead to reads of the MAC header when it was never
> set or does not span a full Ethernet header, resulting in out-of-bounds access.
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> jammy: clean cherry-pick
> focal: backported with AI-assisted adaptation
> bionic: backported with AI-assisted adaptation
> xenial: backported with AI-assisted adaptation
> trusty: backported with AI-assisted adaptation
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> An incorrect fix could reject or mishandle legitimate packets in the
> netfilter/ipset paths, causing dropped traffic or ruleset matching failures for
> MAC-based rules. Regressions would be confined to the netfilter and ipset
> subsystems.
> 

Applied to noble:linux-hwe-6.17/hwe-6.17-next and 
jammy:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 52669 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260717/f6213c89/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260717/f6213c89/attachment-0001.sig>