CVE-2026-53245— net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr In mrp_pdu_parse_vecattr(), vector attribute events are encoded three per byte and valen tracks the number of events left to process. The parser decrements valen after processing the first and second events from each event byte, but not after processing the third one. When valen is exactly a multiple of three, the loop continues after the last valid event and consumes the next byte as a new event byte, applying a spurious event to the MRP applicant state. Additionally, when valen is zero the parser unconditionally consumes attrlen bytes as FirstValue and advances the offset, even though per IEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of zero and no FirstValue or Vector fields. This corrupts the offset for subsequent PDU parsing. Also, when valen exceeds three the loop crosses byte boundaries but the attribute value is not incremented between the last event of one byte and the first event of the next. This causes the first event of the next byte to use the same attribute value as the third event rather than the next consecutive value. Decrement valen after processing the third event, skip FirstValue consumption when valen is zero, and increment the attribute value at the end of each loop iteration.

N/A

N/A

Linux kernel 安全漏洞

Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mrp_pdu_parse_vecattr函数中向量属性解析逻辑错误，包括：处理第三个事件后未递减valen、valen为零时无条件消耗FirstValue以及跨字节边界时属性值未递增，可能导致错误事件被应用到MRP申请人状态、后续PDU解析偏移损坏及属性值重复使用。以下版本受到影响：3.9版本。

N/A

N/A