CVE-2026-53074 bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
A missing length check in the Linux kernel BPF test run function allows attackers to cause a denial of service via crafted short network packets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53074?
CVE-2026-53074 is a medium-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
bpf_prog_test_run_skb() calls eth_type_trans() first and then uses skb->protocol to initialize sk family and address fields for the test run.
For IPv4 and IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb) even when the provided test input only contains an Ethernet header.
Reject the input earlier if the Ethernet frame carries IPv4/IPv6 EtherType but the L3 header is too short.
Fold the IPv4/IPv6 header length checks into the existing protocol switch and return -EINVAL before accessing the network headers.
Which versions are affected by CVE-2026-53074?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53074?
Apply the vendor's patch.
Is CVE-2026-53074 being exploited?
There is no known exploitation of CVE-2026-53074 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53074, DEBIAN-CVE-2026-53074, GHSA-fqx6-8jf8-vfj2, ROOT-OS-DEBIAN-11-CVE-2026-53074, ROOT-OS-DEBIAN-12-CVE-2026-53074, ROOT-OS-UBUNTU-2204-CVE-2026-53074 and 2 more.