CVE-2026-53074
kernel: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 24, 2026
Updated · July 22, 2026
Description
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. Specifically, the bpf_prog_test_run_skb() function, responsible for testing BPF programs with network packets, did not properly validate the length of IPv4 and IPv6 inputs. This could allow the kernel to attempt to access network header information even when the provided packet data was too short, potentially leading to system instability or unexpected behavior.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-1284 · Improper Validation of Specified Quantity in Input