CVE-2026-53074 Overview
CVE-2026-53074 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in the bpf_prog_test_run_skb() function, which calls eth_type_trans() and then uses skb->protocol to initialize socket family and address fields for a test run. When the supplied test input contains only an Ethernet header but declares an IPv4 or IPv6 EtherType, the kernel accesses ip_hdr(skb) or ipv6_hdr(skb) beyond the available data. The upstream fix rejects such short inputs earlier in the protocol switch and returns -EINVAL before any network header dereference.
Critical Impact
Local users able to invoke BPF test-run interfaces can trigger out-of-bounds reads of kernel memory adjacent to short test packets, leading to information disclosure or kernel instability.
Affected Products
- Linux kernel branches containing bpf_prog_test_run_skb() prior to the referenced stable commits
- Distributions shipping vulnerable upstream kernels that expose BPF_PROG_TEST_RUN to user space
- Container and virtualization hosts permitting unprivileged or CAP_BPF/CAP_NET_ADMIN workloads to invoke BPF test interfaces
Discovery Timeline
- 2026-06-24 - CVE-2026-53074 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53074
Vulnerability Analysis
The vulnerability is an out-of-bounds read in the BPF test-run path for SKB programs. bpf_prog_test_run_skb() accepts a user-supplied buffer that is treated as a raw Ethernet frame. The function calls eth_type_trans() to set skb->protocol based on the EtherType field, then dispatches on that protocol to populate socket family and address state from the assumed IPv4 or IPv6 header.
The original code did not verify that the supplied buffer was large enough to contain the L3 header it claimed to carry. A frame containing only the 14-byte Ethernet header but advertising ETH_P_IP or ETH_P_IPV6 caused the kernel to dereference ip_hdr(skb) or ipv6_hdr(skb) against memory past the end of the linear data area.
Root Cause
The root cause is missing input validation [Improper Input Validation] between the L2 parse and L3 access stages. The protocol switch trusted skb->protocol without confirming that skb->len covered sizeof(struct iphdr) or sizeof(struct ipv6hdr). The fix folds explicit length checks into the existing protocol switch and returns -EINVAL before the network header pointer is used.
Attack Vector
An attacker with the ability to call bpf(BPF_PROG_TEST_RUN, ...) against an SKB-type program supplies a crafted short frame whose EtherType declares IPv4 or IPv6. The kernel then reads from memory beyond the supplied packet bytes when populating sk family and address fields. The result is an out-of-bounds read that may leak adjacent kernel memory contents into test-run output state or cause a fault, depending on allocator layout.
No exploitation in the wild has been reported. Patches are distributed across multiple stable branches as referenced in the Kernel Git Commit 0a04db2 and related stable commits.
Detection Methods for CVE-2026-53074
Indicators of Compromise
- Unexpected bpf() syscalls issuing BPF_PROG_TEST_RUN with data_size_in values close to 14 bytes from non-administrative workloads.
- Kernel log entries showing -EINVAL returns from bpf_prog_test_run_skb on patched systems, indicating probing attempts.
- Processes holding CAP_BPF, CAP_SYS_ADMIN, or CAP_NET_ADMIN that have no operational reason to run BPF self-tests.
Detection Strategies
- Audit eBPF program loads and test-run invocations using auditd rules on the bpf syscall, filtering for the BPF_PROG_TEST_RUN command.
- Correlate BPF test-run invocations with anomalous container or sandboxed workload activity.
- Inventory installed kernel versions against the fixed stable commits to confirm patch presence.
Monitoring Recommendations
- Forward auditd BPF telemetry and kernel ring buffer events to a centralized log pipeline for retention and search.
- Alert on first-time use of BPF_PROG_TEST_RUN from any service account or container.
- Track kernel package versions across the fleet and flag hosts running pre-patch builds.
How to Mitigate CVE-2026-53074
Immediate Actions Required
- Apply the latest stable kernel update from your distribution that includes the referenced upstream commits.
- Restrict CAP_BPF and CAP_SYS_ADMIN to workloads that require them and remove them from general-purpose containers.
- Disable unprivileged BPF where operationally feasible by setting kernel.unprivileged_bpf_disabled=1.
Patch Information
The upstream fix adds explicit IPv4 and IPv6 header length checks inside the protocol switch in bpf_prog_test_run_skb() and returns -EINVAL before any network header dereference. Stable backports are available across multiple branches via the Kernel Git Commit 12bec2b, Kernel Git Commit 1f882c4, Kernel Git Commit 6a9f38d, Kernel Git Commit 6def5f3, Kernel Git Commit 7254267, Kernel Git Commit 8042240, and Kernel Git Commit e6aa481.
Workarounds
- Set kernel.unprivileged_bpf_disabled=1 via sysctl to block unprivileged callers from reaching the affected path.
- Use seccomp or Linux Security Modules (LSM) policies to deny the bpf syscall in container images that do not require it.
- Remove CAP_BPF and CAP_NET_ADMIN from non-privileged service accounts and Kubernetes pod security contexts.
# Configuration example
# Disable unprivileged BPF until the kernel patch is deployed
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf
# Audit BPF_PROG_TEST_RUN invocations
auditctl -a always,exit -F arch=b64 -S bpf -k bpf_syscalls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
