CVE-2026-53014

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

In tcf_blockcast_redir(), when iterating block ports to redirect

packets to multiple devices, the mac_header_xmit flag is queried

from the wrong device. The loop sends to dev_prev but queries

dev_is_mac_header_xmit(dev) — which is the NEXT device in the

iteration, not the one being sent to.

This causes tcf_mirred_to_dev() to make incorrect decisions about

whether to push or pull the MAC header. When the block contains

mixed device types (e.g., an ethernet veth and a tunnel device),

intermediate devices get the wrong mac_header_xmit flag, leading to

skb header corruption. In the worst case, skb_push_rcsum with an

incorrect mac_len can exhaust headroom and panic.

The last device in the loop is handled correctly (line 365-366 uses

dev_is_mac_header_xmit(dev_prev)), confirming this is a copy-paste

oversight for the intermediate devices.

Fix by using dev_prev instead of dev for the mac_header_xmit query,

consistent with the device actually being sent to.