Executive brief
A vulnerability was identified in the Linux kernel's BPF subsystem, which is used for high-performance networking and system monitoring. The issue occurs when the system processes specially crafted network test data that is too short, potentially causing the system to read memory incorrectly. This could lead to system instability or crashes during development or testing activities.
Technical details
A vulnerability in `bpf_prog_test_run_skb()` in the Linux kernel allowed for potential out-of-bounds memory access. The function called `eth_type_trans()` and subsequently accessed `ip_hdr(skb)` or `ipv6_hdr(skb)` based on the EtherType without verifying that the provided test input was long enough to actually contain an L3 header. An attacker or developer providing a short input (e.g., only an Ethernet header) could trigger an invalid memory read. The fix introduces explicit length checks for IPv4 and IPv6 headers before accessing their fields, returning -EINVAL if the input is insufficient.
Affected products
- Linux Linux Kernel 5.9 to 5.10.258, 5.15.209, 6.1.95, 6.6.35, 6.9.6
Timeline
- 2026-04-08: disclosed: Initial patch submitted by Sun Jian
- 2026-04-12: patched: Patch committed to mainline kernel
- 2026-06-24: advisory: CVE-2026-53074 published
References
- https://git.kernel.org/stable/c/0a04db240effd85773f66244645a28cedddb72d2
- https://git.kernel.org/stable/c/12bec2bd4b76d81c5d3996bd14ec1b7f4d983747
- https://git.kernel.org/stable/c/1f882c492d46f90bdb36f4936876c88c28dab21c
- https://git.kernel.org/stable/c/6a9f38d5ff11e00bc54baab752642978805e81eb
- https://git.kernel.org/stable/c/6def5fe753cbe5b279ee5fd10327b2611cbddaca
- https://git.kernel.org/stable/c/7254267799d083280c0e53effc101a33add95f7b
- https://git.kernel.org/stable/c/8042240412de3222d27b31e89d29336961cad9e4