CVE-2026-53111: Linux Kernel BPF Test_Run Null Pointer Dereference DoS

Technical summary

CVE-2026-53111 involves a null pointer dereference in bpf_lwt_xmit_push_encap within the Linux kernel's BPF testing infrastructure. The vulnerability occurs because the bpf_lwt_push_ip_encap helper function accesses skb_dst(skb)->dev to calculate headroom requirements via skb_cow_head(), but the bpf_prog_test_run_skb function may initialize socket buffers without setting the skb->_skb_refdst field. When a BPF program under test invokes encapsulation helpers, the uninitialized destination reference causes dereferencing of a null pointer, triggering a kernel panic. The fix involves initializing skb->_skb_refdst before executing the test harness.

Business impact

This vulnerability enables local attackers to crash Linux systems by submitting specially crafted BPF programs through the kernel's BPF testing interface. While exploitation requires local access and appropriate capabilities to use the BPF subsystem, successful exploitation results in immediate kernel panic and system unavailability. For development environments, CI/CD pipelines, and container platforms where untrusted users may load BPF programs, this represents a practical denial-of-service vector. Systems hosting BPF-based security tools or network packet processing are at elevated risk.

Affected systems

The Linux kernel is affected across versions prior to the patch. The vulnerability is specific to systems where the BPF subsystem is enabled and the test_run interface is accessible. This includes standard kernel configurations on modern Linux distributions, Kubernetes nodes using BPF-based networking (Cilium, etc.), and development systems with BPF tooling. The issue is most practically exploitable on systems where BPF program loading is permitted to unprivileged or semi-privileged users.

Exploitability

Exploitability is moderate but practical. The vulnerability requires local access and the ability to invoke BPF syscalls (CAP_BPF or CAP_SYS_ADMIN depending on kernel version), which is not typically available to arbitrary unprivileged users by default. However, it may be accessible in containerized environments, development machines, or systems with overly permissive BPF access controls. No authentication bypass or privilege escalation is needed—only the ability to submit a BPF test run request. Public proof-of-concept code exists, but no evidence indicates active exploitation in the wild.

Remediation

The fix involves initializing the socket buffer's destination reference (skb->_skb_refdst) before invoking the BPF test harness. This ensures that encapsulation helpers have valid network device information available. The patch is minimal and surgical, addressing the root cause without broad subsystem changes. Administrators should update to patched kernel versions as soon as feasible, prioritizing systems where BPF program testing is frequent or BPF access is broadly permitted.

Patch guidance

Patch availability depends on your Linux distribution and kernel version. Check your vendor's security advisory for specific patched kernel versions (verify against the vendor advisory for your distribution). For distributions following upstream Linux releases, the fix appears in kernel versions addressing this CVE post-June 2026. Enable automatic security updates where possible, and test kernel updates in non-production environments before broad deployment. If immediate patching is delayed, restrict BPF program loading to trusted administrators only.

Detection guidance

Monitor kernel logs for BPF-related panic messages, particularly those referencing bpf_lwt_push_ip_encap or null pointer dereferences in BPF code paths. Enable audit logging for BPF syscalls (bpf() system call invocations) to track which users or processes are attempting to load or test BPF programs. On systems where unexpected BPF activity is rare, anomalous BPF test_run invocations should trigger investigation. Check kernel version and confirmed patch status regularly; unpatched systems remain vulnerable until updates are applied.

Why prioritize this

Although rated MEDIUM severity due to local-only access requirements, this vulnerability warrants prompt attention because: (1) it provides straightforward denial-of-service against critical kernel infrastructure, (2) modern container and Kubernetes deployments increasingly expose BPF capabilities, and (3) no workaround exists short of disabling BPF or severely restricting access. Prioritize patching for development systems, container platforms, and any infrastructure where BPF-based tools are operationally important.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects local attack vector (AV:L), low complexity (AC:L), and low privilege requirements (PR:L), with impact limited to availability (A:H). The score appropriately captures that exploitation requires local access and some level of privilege, but the resulting kernel crash is a complete availability impact. The score does not account for operational context—organizations heavily reliant on BPF for networking or security should weight this higher than the base score suggests.

Frequently asked questions