Skip to main content

Linux Kernel CVE-2026-53111

| EUVDEUVD-2026-38979 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-gj9x-pqvx-p5mh
Denial Of Service Linux Debian Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges (BPF syscall capability) required; impact limited to kernel crash (availability only); no confidentiality or integrity impact is possible from this flaw.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:45 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap

The bpf_lwt_xmit_push_encap helper needs to access skb_dst(skb)->dev to calculate the needed headroom:

err = skb_cow_head(skb, len + LL_RESERVED_SPACE(skb_dst(skb)->dev));

But skb->_skb_refdst may not be initialized when the skb is set up by bpf_prog_test_run_skb function. Executing bpf_lwt_push_ip_encap function in this scenario will trigger null pointer dereference, causing a kernel crash as Yinhao reported:

[ 105.186365] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 105.186382] #PF: supervisor read access in kernel mode [ 105.186388] #PF: error_code(0x0000) - not-present page [ 105.186393] PGD 121d3d067 P4D 121d3d067 PUD 106c83067 PMD 0 [ 105.186404] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 105.186412] CPU: 3 PID: 3250 Comm: poc Kdump: loaded Not tainted 6.19.0-rc5 #1 [ 105.186423] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.186427] RIP: 0010:bpf_lwt_push_ip_encap+0x1eb/0x520 [ 105.186443] Code: 0f 84 de 01 00 00 0f b7 4a 04 66 85 c9 0f 85 47 01 00 00 31 c0 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8b 73 58 48 83 e6 fe <48> 8b 36 0f b7 be ec 00 00 00 0f b7 b6 e6 00 00 00 01 fe 83 e6 f0 [ 105.186449] RSP: 0018:ffffbb0e0387bc50 EFLAGS: 00010246 [ 105.186455] RAX: 000000000000004e RBX: ffff94c74e036500 RCX: ffff94c74874da00 [ 105.186460] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff94c74e036500 [ 105.186463] RBP: 0000000000000001 R08: 0000000000000002 R09: 0000000000000000 [ 105.186467] R10: ffffbb0e0387bd50 R11: 0000000000000000 R12: ffffbb0e0387bc98 [ 105.186471] R13: 0000000000000014 R14: 0000000000000000 R15: 0000000000000002 [ 105.186484] FS: 00007f166aa4d680(0000) GS:ffff94c8b7780000(0000) knlGS:0000000000000000 [ 105.186490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.186494] CR2: 0000000000000000 CR3: 000000015eade001 CR4: 0000000000770ee0 [ 105.186499] PKRU: 55555554 [ 105.186502] Call Trace: [ 105.186507] <TASK> [ 105.186513] bpf_lwt_xmit_push_encap+0x2b/0x40 [ 105.186522] bpf_prog_a75eaad51e517912+0x41/0x49 [ 105.186536] ? kvm_clock_get_cycles+0x18/0x30 [ 105.186547] ? ktime_get+0x3c/0xa0 [ 105.186554] bpf_test_run+0x195/0x320 [ 105.186563] ? bpf_test_run+0x10f/0x320 [ 105.186579] bpf_prog_test_run_skb+0x2f5/0x4f0 [ 105.186590] __sys_bpf+0x69c/0xa40 [ 105.186603] __x64_sys_bpf+0x1e/0x30 [ 105.186611] do_syscall_64+0x59/0x110 [ 105.186620] entry_SYSCALL_64_after_hwframe+0x76/0xe0 [ 105.186649] RIP: 0033:0x7f166a97455d

Temporarily add the setting of skb->_skb_refdst before bpf_test_run to resolve the issue.

AnalysisAI

Null pointer dereference in the Linux kernel's BPF LWT (Lightweight Tunnel) subsystem allows a local user with BPF syscall privileges to crash the kernel via a denial-of-service. The flaw exists because bpf_prog_test_run_skb constructs a socket buffer (skb) without initializing skb->_skb_refdst; when a BPF program invokes the bpf_lwt_xmit_push_encap helper through this test path, the subsequent dereference of skb_dst(skb)->dev hits a null pointer and triggers a kernel panic. No public exploit or CISA KEV listing exists, and EPSS is very low at 0.18% (7th percentile), consistent with the specialized access required.

Technical ContextAI

The Linux kernel BPF subsystem supports attaching programs to Lightweight Tunnels (LWT) for custom IP encapsulation via the bpf_lwt_xmit_push_encap helper, which internally calls bpf_lwt_push_ip_encap. That function calls skb_cow_head() with LL_RESERVED_SPACE(skb_dst(skb)->dev) to calculate needed headroom. The BPF_PROG_TEST_RUN interface (bpf_prog_test_run_skb) sets up a synthetic skb for testing purposes but does not initialize skb->_skb_refdst, leaving skb_dst(skb) as NULL. Dereferencing that NULL pointer causes an immediate kernel oops at address 0x0000000000000000, as confirmed in the crash trace at bpf_lwt_push_ip_encap+0x1eb/0x520. Root cause class is CWE-476 (NULL Pointer Dereference) arising from missing initialization in the test execution code path. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade the Linux kernel to a fixed version: 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1, available via the kernel stable trees at git.kernel.org/stable (fix commits: 5c8d1f91fc48, c7ad31fb948f, 599905c3f10b, 5500913516e0, 94f95328b907, 972787479ee7). Ubuntu users should apply the patches from USN-8566-1, USN-8567-1, or USN-8568-1 via standard package management. Where immediate patching is not feasible, restrict BPF syscall access as a compensating control: set sysctl kernel.unprivileged_bpf_disabled=1 to block unprivileged BPF loading - note this may break observability tools (e.g., BCC, bpftrace) run without root. Alternatively, deploy seccomp profiles or LSM (SELinux/AppArmor) policies that deny the BPF syscall to untrusted processes. Restricting CAP_NET_ADMIN and CAP_BPF from containers and unprivileged namespaces also eliminates the attack surface. None of these workarounds affect normal network traffic; they only limit BPF program loading and execution.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53111 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy