CVE-2026-53238

A flaw was found in the Linux kernel's NetLabel subsystem. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by crashing the system. The issue occurs because the kernel verifies the length of address attributes but fails to independently validate the length of corresponding network mask attributes. By sending a crafted Generic Netlink message containing an unexpectedly short mask attribute, a local user can trigger an out-of-bounds memory read, leading to a kernel crash.

Red Hat has evaluated this vulnerability as having a Moderate severity impact because exploitation requires local access to transmit malformed Generic Netlink messages to the NetLabel subsystem, limiting the blast radius to a denial of service (kernel crash). In typical Red Hat Enterprise Linux environments, interacting with network labeling configuration interfaces requires elevated privileges such as CAP_NET_ADMIN. Because arbitrary code execution and data exposure are not feasible through this out-of-bounds read, the risk remains contained below the Important threshold.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.