CVE-2026-53111

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap

The bpf_lwt_xmit_push_encap helper needs to access skb_dst(skb)->dev to

calculate the needed headroom:

err = skb_cow_head(skb,

len + LL_RESERVED_SPACE(skb_dst(skb)->dev));

But skb->_skb_refdst may not be initialized when the skb is set up by

bpf_prog_test_run_skb function. Executing bpf_lwt_push_ip_encap function

in this scenario will trigger null pointer dereference, causing a kernel

crash as Yinhao reported:

[ 105.186365] BUG: kernel NULL pointer dereference, address: 0000000000000000

[ 105.186382] #PF: supervisor read access in kernel mode

[ 105.186388] #PF: error_code(0x0000) - not-present page

[ 105.186393] PGD 121d3d067 P4D 121d3d067 PUD 106c83067 PMD 0

[ 105.186404] Oops: 0000 [#1] PREEMPT SMP NOPTI

[ 105.186412] CPU: 3 PID: 3250 Comm: poc Kdump: loaded Not tainted 6.19.0-rc5 #1

[ 105.186423] Hardware name: QEMU S

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References