PT-2026-51968 · Linux · Linux

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-53074

Mitre

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject short IPv4/IPv6 inputs in bpf prog test run skb

bpf prog test run skb() calls eth type trans() first and then uses skb->protocol to initialize sk family and address fields for the test run.

For IPv4 and IPv6 packets, it may access ip hdr(skb) or ipv6 hdr(skb) even when the provided test input only contains an Ethernet header.

Reject the input earlier if the Ethernet frame carries IPv4/IPv6 EtherType but the L3 header is too short.

Fold the IPv4/IPv6 header length checks into the existing protocol switch and return -EINVAL before accessing the network headers.

Related Identifiers

CVE-2026-53074

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53074 · Security Note
• https://git.kernel.org/stable/c/e6aa481f21fc7a41ed344767ea25aae9d03fae71 · Note
• https://git.kernel.org/stable/c/6a9f38d5ff11e00bc54baab752642978805e81eb · Note
• https://git.kernel.org/stable/c/12bec2bd4b76d81c5d3996bd14ec1b7f4d983747 · Note
• https://git.kernel.org/stable/c/8042240412de3222d27b31e89d29336961cad9e4 · Note
• https://git.kernel.org/stable/c/6def5fe753cbe5b279ee5fd10327b2611cbddaca · Note
• https://git.kernel.org/stable/c/0a04db240effd85773f66244645a28cedddb72d2 · Note
• https://git.kernel.org/stable/c/1f882c492d46f90bdb36f4936876c88c28dab21c · Note
• https://git.kernel.org/stable/c/7254267799d083280c0e53effc101a33add95f7b · Note