CVE-2026-53013

In the Linux kernel, the following vulnerability has been resolved:

macvlan: fix macvlangetsize() not reserving space for IFLAMACVLANBC_CUTOFF

macvlangetsize() does not account for IFLAMACVLANBCCUTOFF, but macvlanfillinfo() conditionally includes it when port->bccutoff != 1. This causes nlaputs32() to fail with -EMSGSIZE when the netlink skb runs out of space, triggering a WARN_ON in rtnetlink and preventing the interface from being dumped.

The bug can be reproduced with:

ip link add macvlan0 link eth0 type macvlan mode bridge ip link set macvlan0 type macvlan bc_cutoff 0 ip -d link show macvlan0 # fails with -EMSGSIZE

The bccutoff feature was added in commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff"), which added the nlaputs32() call in macvlanfillinfo() but missed adding the corresponding nlatotalsize(4) in macvlangetsize(). A follow-up commit 55cef78c244d ("macvlan: add forgotten nlapolicy for IFLAMACVLANBCCUTOFF") fixed the missing nlapolicy entry but still did not fix the size calculation.