Linux Kernel EUVD-2026-38942

The vulnerable function bpf_prog_test_run_skb() is invoked via the bpf(2) syscall with the BPF_PROG_TEST_RUN command, enabling developers and test harnesses to inject synthetic packets into loaded BPF socket filter or XDP programs. After eth_type_trans() sets skb->protocol based on the Ethernet EtherType field, the function enters a protocol switch to populate socket family and address fields: for ETH_P_IP it dereferences ip_hdr(skb), and for ETH_P_IPV6 it dereferences ipv6_hdr(skb). No prior check confirmed that the sk_buff's data region was large enough to hold an IPv4 header (minimum 20 bytes past the Ethernet frame) or an IPv6 header (40 bytes). Providing only a 14-byte Ethernet header with EtherType 0x0800 or 0x86DD causes the kernel to read beyond the allocated buffer. Although the CWE field is unassigned, the root cause maps to CWE-125 (Out-of-bounds Read) combined with CWE-20 (Improper Input Validation) at the BPF syscall boundary. The affected CPE (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) spans all Linux kernel versions from the vulnerability-introducing commit fa5cb548ced61b9d3095f32f8a7e427a248c65ee (introduced at Linux 5.9) through to the respective stable-branch patch commits.