CVE-2026-53111: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53111 Overview

CVE-2026-53111 is a null pointer dereference vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The flaw resides in the bpf_lwt_xmit_push_encap helper, which accesses skb_dst(skb)->dev to calculate required headroom. When a socket buffer (skb) is set up through the bpf_prog_test_run_skb test infrastructure, the skb->_skb_refdst field may remain uninitialized. Invoking bpf_lwt_push_ip_encap on such an skb dereferences a NULL destination pointer and triggers a kernel crash. A local unprivileged user with the ability to load BPF programs can reach the vulnerable code path through the BPF_PROG_TEST_RUN syscall command.

Critical Impact
Local users capable of invoking the BPF test_run interface can crash the Linux kernel through a NULL pointer dereference, resulting in denial of service.

Affected Products

Linux kernel (mainline, confirmed reproducible on 6.19.0-rc5)
Stable kernel branches addressed by commits 5500913516e0, 599905c3f10b, 5c8d1f91fc48, 94f95328b907, 972787479ee7, and c7ad31fb948f
Distributions shipping affected kernel versions that expose BPF program loading to unprivileged users

Discovery Timeline

2026-06-24 - CVE-2026-53111 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53111

Vulnerability Analysis

The vulnerability is classified as a [CWE-476] NULL pointer dereference in the Linux kernel BPF subsystem. The helper bpf_lwt_xmit_push_encap calls skb_cow_head(skb, len + LL_RESERVED_SPACE(skb_dst(skb)->dev)) to ensure sufficient headroom for IP encapsulation. This calculation requires a valid destination entry (dst_entry) attached to the skb via skb->_skb_refdst.

When the skb originates from bpf_prog_test_run_skb, the test harness does not populate _skb_refdst. Calling skb_dst(skb) returns NULL, and the subsequent dereference of ->dev faults at virtual address 0x0. The crash signature reported by Yinhao shows the fault at bpf_lwt_push_ip_encap+0x1eb/0x520 reached through bpf_lwt_xmit_push_encap+0x2b/0x40 and bpf_test_run+0x195/0x320 from the __sys_bpf syscall path.

Root Cause

The root cause is missing initialization of skb->_skb_refdst in the BPF test_run path. Production network code paths attach a valid dst_entry before invoking lightweight tunnel encapsulation helpers, but the test_run harness creates a synthetic skb and dispatches the BPF program without that prerequisite. The encapsulation helper assumes the invariant holds and performs no NULL check before dereferencing the destination device.

Attack Vector

The attack vector is local. An attacker loads a BPF program that calls bpf_lwt_push_encap (or another path reaching bpf_lwt_xmit_push_encap) and then triggers it via the BPF_PROG_TEST_RUN command of the bpf() syscall with BPF_PROG_TYPE_LWT_XMIT. Execution dereferences the uninitialized destination pointer and produces a kernel oops, which can panic the host depending on panic_on_oops configuration.

No exploitation code or public proof-of-concept beyond the reporter's crash trace is referenced in the advisory. See the upstream fix in Linux Kernel Commit 5c8d1f91 for the corrective change.

Detection Methods for CVE-2026-53111

Indicators of Compromise

Kernel oops messages referencing BUG: kernel NULL pointer dereference with RIP: bpf_lwt_push_ip_encap in the instruction pointer
Call stacks containing bpf_lwt_xmit_push_encap followed by bpf_test_run and bpf_prog_test_run_skb
Unexpected kernel crashes or reboots correlated with processes invoking the bpf() syscall with command BPF_PROG_TEST_RUN

Detection Strategies

Monitor kernel ring buffer and journalctl -k output for oops traces involving bpf_lwt_push_ip_encap or bpf_lwt_xmit_push_encap
Audit BPF program loads using auditd rules on the bpf syscall, filtering for program types BPF_PROG_TYPE_LWT_XMIT and BPF_PROG_TYPE_LWT_IN
Inspect installed kernel package versions against vendor patch advisories that reference the commits listed in the External References

Monitoring Recommendations

Enable kernel.panic_on_oops=0 only in non-production diagnostic environments so oops events are captured rather than masked by reboot
Forward kernel logs to a centralized logging platform and alert on NULL pointer dereference events whose stack contains BPF helpers
Track BPF syscall telemetry from unprivileged user contexts and review which process loaded the offending program

How to Mitigate CVE-2026-53111

Immediate Actions Required

Apply the upstream kernel patches that initialize skb->_skb_refdst before invoking bpf_test_run for lightweight tunnel program types
Update to a distribution kernel that incorporates the fix referenced by commits 5500913516e0, 599905c3f10b, 5c8d1f91fc48, 94f95328b907, 972787479ee7, and c7ad31fb948f
Restrict access to the bpf() syscall on multi-tenant or untrusted-user systems by setting kernel.unprivileged_bpf_disabled=1

Patch Information

The fix temporarily sets skb->_skb_refdst before calling bpf_test_run so the encapsulation helper finds a valid destination pointer. Patch commits are available at Linux Kernel Commit 5500913516e0, Linux Kernel Commit 599905c3f10b, Linux Kernel Commit 5c8d1f91fc48, Linux Kernel Commit 94f95328b907, Linux Kernel Commit 972787479ee7, and Linux Kernel Commit c7ad31fb948f.

Workarounds

Disable unprivileged BPF program loading system-wide with the kernel.unprivileged_bpf_disabled sysctl
Apply seccomp filters or Linux Security Module policies that block the bpf() syscall for workloads that do not require it
Constrain containers to seccomp profiles that exclude bpf from the allowed syscall set until kernels are patched

bash

# Configuration example
# Disable unprivileged BPF and persist across reboots
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf

# Verify current setting
sysctl kernel.unprivileged_bpf_disabled