Junglewise Threat Intelligence

CVE-2026-53111: Linux kernel null pointer dereference in BPF test_run

CVE-2026-53111 · Severity: info · CVSS 5.5 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's BPF subsystem could allow a local user to crash the system. The issue occurs when running specific network-related BPF test programs that attempt to access uninitialized memory. This results in a kernel panic (system crash), impacting the availability of the affected machine.

Technical details

A null pointer dereference exists in the bpf_lwt_xmit_push_encap helper within the Linux kernel. The vulnerability is triggered when bpf_prog_test_run_skb is used to execute BPF programs of type BPF_PROG_TYPE_LWT_XMIT, as the skb->_skb_refdst field may remain uninitialized. When the helper attempts to access the destination device via skb_dst(skb)->dev to calculate headroom, it encounters a NULL pointer, leading to a kernel oops. The fix involves ensuring the destination reference is properly set before the test run.

Affected products

  • Linux Linux kernel Fixed in 5.10.218, 5.15.160, 6.1.92, 6.6.32, 6.8.11, 6.9.2

Timeline

  • 2026-03-04: patched: Initial patch submitted by Feng Yang
  • 2026-06-24: advisory: CVE-2026-53111 published by NVD

References

Related threats