CVE-2026-53014

In the Linux kernel, the following vulnerability has been resolved:

net/sched: actmirred: fix wrong device for macheaderxmit check in tcfblockcast_redir

In tcfblockcastredir(), when iterating block ports to redirect packets to multiple devices, the macheaderxmit flag is queried from the wrong device. The loop sends to devprev but queries devismacheader_xmit(dev) — which is the NEXT device in the iteration, not the one being sent to.

This causes tcfmirredtodev() to make incorrect decisions about whether to push or pull the MAC header. When the block contains mixed device types (e.g., an ethernet veth and a tunnel device), intermediate devices get the wrong macheaderxmit flag, leading to skb header corruption. In the worst case, skbpushrcsum with an incorrect maclen can exhaust headroom and panic.

The last device in the loop is handled correctly (line 365-366 uses devismacheaderxmit(dev_prev)), confirming this is a copy-paste oversight for the intermediate devices.

Fix by using devprev instead of dev for the macheader_xmit query, consistent with the device actually being sent to.