Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-24T00:00:00 kernel: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CWE-1284

In the Linux kernel, the following vulnerability has been resolved: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb bpf_prog_test_run_skb() calls eth_type_trans() first and then uses skb->protocol to initialize sk family and address fields for the test run. For IPv4 and IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb) even when the provided test input only contains an Ethernet header. Reject the input earlier if the Ethernet frame carries IPv4/IPv6 EtherType but the L3 header is too short. Fold the IPv4/IPv6 header length checks into the existing protocol switch and return -EINVAL before accessing the network headers.

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. Specifically, the `bpf_prog_test_run_skb()` function, responsible for testing BPF programs with network packets, did not properly validate the length of IPv4 and IPv6 inputs. This could allow the kernel to attempt to access network header information even when the provided packet data was too short, potentially leading to system instability or unexpected behavior.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-53074 https://nvd.nist.gov/vuln/detail/CVE-2026-53074 https://lore.kernel.org/linux-cve-announce/2026062405-CVE-2026-53074-fb09@gregkh/T