Skip to main content

Linux Kernel CVE-2026-53111

| EUVDEUVD-2026-38979 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-gj9x-pqvx-p5mh
Denial Of Service Linux Null Pointer Dereference Debian Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local access with CAP_BPF or CAP_NET_ADMIN
  2. Delivery
    Craft BPF LWT program invoking bpf_lwt_xmit_push_encap
  3. Exploit
    Submit program via BPF syscall (BPF_PROG_LOAD)
  4. Execution
    Trigger BPF_PROG_TEST_RUN with crafted skb
  5. Persist
    bpf_prog_test_run_skb creates skb without initializing _skb_refdst
  6. Impact
    NULL dereference in bpf_lwt_push_ip_encap crashes kernel

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The attacker must have local access to a system running an unpatched Linux kernel and must hold privileges sufficient to invoke the BPF syscall with BPF_PROG_TEST_RUN - specifically CAP_BPF or CAP_NET_ADMIN. The BPF program must be an LWT-type program that invokes the bpf_lwt_xmit_push_encap helper. The trigger path is specifically the bpf_prog_test_run_skb test interface, not normal LWT packet forwarding; the vulnerability does not exist in the normal LWT data plane. On systems where kernel.unprivileged_bpf_disabled=1 (the default on many modern distributions), exploitation is further limited to root or capability-holding processes. Exploitation is bounded to kernel availability impact only - no confidentiality or integrity impact is possible from this flaw.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects local availability-only impact with low privilege requirements and no attack complexity. This is consistent with the technical description: exploiting the flaw requires local system access and BPF syscall capability (typically CAP_BPF or CAP_NET_ADMIN). EPSS at 0.18% (7th percentile) is very low, signaling minimal observed or anticipated exploitation activity. There is no CISA KEV listing and no public exploit code has been identified. The primary real-world risk is in multi-tenant environments - cloud VMs, Kubernetes nodes, or container platforms - where users may have BPF access granted via capability or where kernel.unprivileged_bpf_disabled=0. On hardened single-tenant systems with BPF restricted to privileged users, the practical exploitability is further limited. This vulnerability is a genuine denial-of-service but a low-to-medium operational priority for most organizations given the access prerequisites and lack of weaponized exploit.
Exploit ScenarioDerived

A local user in a container environment with CAP_BPF or CAP_NET_ADMIN loads a BPF LWT program containing a call to the bpf_lwt_xmit_push_encap helper and invokes BPF_PROG_TEST_RUN via the BPF syscall. The kernel constructs the test skb without initializing its destination pointer; when the helper tries to read skb_dst(skb)->dev to compute headroom, it dereferences NULL at address 0x0, triggering an oops and crashing the entire host kernel - affecting all co-located containers and workloads. A minimal PoC was demonstrated by Yinhao and referenced in the kernel commit message.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Null pointer dereference in the Linux kernel's BPF LWT (Lightweight Tunnel) subsystem allows a local user with BPF syscall privileges to crash the kernel via a denial-of-service. The flaw exists because bpf_prog_test_run_skb constructs a socket buffer (skb) without initializing skb->_skb_refdst; when a BPF program invokes the bpf_lwt_xmit_push_encap helper through this test path, the subsequent dereference of skb_dst(skb)->dev hits a null pointer and triggers a kernel panic. No public exploit or CISA KEV listing exists, and EPSS is very low at 0.18% (7th percentile), consistent with the specialized access required.

RemediationAI

Upgrade the Linux kernel to a fixed version: 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1, available via the kernel stable trees at git.kernel.org/stable (fix commits: 5c8d1f91fc48, c7ad31fb948f, 599905c3f10b, 5500913516e0, 94f95328b907, 972787479ee7). Ubuntu users should apply the patches from USN-8566-1, USN-8567-1, or USN-8568-1 via standard package management. Where immediate patching is not feasible, restrict BPF syscall access as a compensating control: set sysctl kernel.unprivileged_bpf_disabled=1 to block unprivileged BPF loading - note this may break observability tools (e.g., BCC, bpftrace) run without root. Alternatively, deploy seccomp profiles or LSM (SELinux/AppArmor) policies that deny the BPF syscall to untrusted processes. Restricting CAP_NET_ADMIN and CAP_BPF from containers and unprivileged namespaces also eliminates the attack surface. None of these workarounds affect normal network traffic; they only limit BPF program loading and execution.

Affected VersionsENISA

Linux 52f278774e796a553be0c869dcaaee6f259ca795 <5500913516e071dbe23e5a404c861dd2d82c9589
Linux 5.1
Linux patch: 6.18.33
Linux 52f278774e796a553be0c869dcaaee6f259ca795 <972787479ee73006fddb5e59ab5c8e733810ff42
Linux patch: 0
Linux patch: 6.6.141
Linux 52f278774e796a553be0c869dcaaee6f259ca795 <599905c3f10bb83e6e6881d5a7f5cea5df07dc23
Linux patch: 7.1
Linux patch: 6.1.175
Linux 52f278774e796a553be0c869dcaaee6f259ca795 <5c8d1f91fc4898d79f29d79c1a6f7c2b3ee66fb0
Linux patch: 6.12.91
Linux 52f278774e796a553be0c869dcaaee6f259ca795 <c7ad31fb948fdd4905263f4324160682c3fa7bc6
Linux patch: 7.0.10
Linux 52f278774e796a553be0c869dcaaee6f259ca795 <94f95328b9070909b5b875c647b17a11d3d85567

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux kernel BPF subsystem supports attaching programs to Lightweight Tunnels (LWT) for custom IP encapsulation via the bpf_lwt_xmit_push_encap helper, which internally calls bpf_lwt_push_ip_encap. That function calls skb_cow_head() with LL_RESERVED_SPACE(skb_dst(skb)->dev) to calculate needed headroom. The BPF_PROG_TEST_RUN interface (bpf_prog_test_run_skb) sets up a synthetic skb for testing purposes but does not initialize skb->_skb_refdst, leaving skb_dst(skb) as NULL. Dereferencing that NULL pointer causes an immediate kernel oops at address 0x0000000000000000, as confirmed in the crash trace at bpf_lwt_push_ip_encap+0x1eb/0x520. Root cause class is CWE-476 (NULL Pointer Dereference) arising from missing initialization in the test execution code path. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local access with low privileges (BPF syscall capability) required; impact limited to kernel crash (availability only); no confidentiality or integrity impact is possible from this flaw.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap

The bpf_lwt_xmit_push_encap helper needs to access skb_dst(skb)->dev to calculate the needed headroom:

err = skb_cow_head(skb, len + LL_RESERVED_SPACE(skb_dst(skb)->dev));

But skb->_skb_refdst may not be initialized when the skb is set up by bpf_prog_test_run_skb function. Executing bpf_lwt_push_ip_encap function in this scenario will trigger null pointer dereference, causing a kernel crash as Yinhao reported:

[ 105.186365] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 105.186382] #PF: supervisor read access in kernel mode [ 105.186388] #PF: error_code(0x0000) - not-present page [ 105.186393] PGD 121d3d067 P4D 121d3d067 PUD 106c83067 PMD 0 [ 105.186404] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 105.186412] CPU: 3 PID: 3250 Comm: poc Kdump: loaded Not tainted 6.19.0-rc5 #1 [ 105.186423] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.186427] RIP: 0010:bpf_lwt_push_ip_encap+0x1eb/0x520 [ 105.186443] Code: 0f 84 de 01 00 00 0f b7 4a 04 66 85 c9 0f 85 47 01 00 00 31 c0 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8b 73 58 48 83 e6 fe <48> 8b 36 0f b7 be ec 00 00 00 0f b7 b6 e6 00 00 00 01 fe 83 e6 f0 [ 105.186449] RSP: 0018:ffffbb0e0387bc50 EFLAGS: 00010246 [ 105.186455] RAX: 000000000000004e RBX: ffff94c74e036500 RCX: ffff94c74874da00 [ 105.186460] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff94c74e036500 [ 105.186463] RBP: 0000000000000001 R08: 0000000000000002 R09: 0000000000000000 [ 105.186467] R10: ffffbb0e0387bd50 R11: 0000000000000000 R12: ffffbb0e0387bc98 [ 105.186471] R13: 0000000000000014 R14: 0000000000000000 R15: 0000000000000002 [ 105.186484] FS: 00007f166aa4d680(0000) GS:ffff94c8b7780000(0000) knlGS:0000000000000000 [ 105.186490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.186494] CR2: 0000000000000000 CR3: 000000015eade001 CR4: 0000000000770ee0 [ 105.186499] PKRU: 55555554 [ 105.186502] Call Trace: [ 105.186507] <TASK> [ 105.186513] bpf_lwt_xmit_push_encap+0x2b/0x40 [ 105.186522] bpf_prog_a75eaad51e517912+0x41/0x49 [ 105.186536] ? kvm_clock_get_cycles+0x18/0x30 [ 105.186547] ? ktime_get+0x3c/0xa0 [ 105.186554] bpf_test_run+0x195/0x320 [ 105.186563] ? bpf_test_run+0x10f/0x320 [ 105.186579] bpf_prog_test_run_skb+0x2f5/0x4f0 [ 105.186590] __sys_bpf+0x69c/0xa40 [ 105.186603] __x64_sys_bpf+0x1e/0x30 [ 105.186611] do_syscall_64+0x59/0x110 [ 105.186620] entry_SYSCALL_64_after_hwframe+0x76/0xe0 [ 105.186649] RIP: 0033:0x7f166a97455d

Temporarily add the setting of skb->_skb_refdst before bpf_test_run to resolve the issue.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Ubiquitous
Linux kernel underpins the majority of server, cloud, and container infrastructure globally
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53111 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373364 REF https://git.kernel.org/stable/c/5500913516e071dbe23e5a404c861dd2d82c9589 REF https://git.kernel.org/stable/c/599905c3f10bb83e6e6881d5a7f5cea5df07dc23 REF https://git.kernel.org/stable/c/5c8d1f91fc4898d79f29d79c1a6f7c2b3ee66fb0 REF https://git.kernel.org/stable/c/94f95328b9070909b5b875c647b17a11d3d85567 REF https://git.kernel.org/stable/c/972787479ee73006fddb5e59ab5c8e733810ff42 REF https://git.kernel.org/stable/c/c7ad31fb948fdd4905263f4324160682c3fa7bc6

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy