CVE-2026-53111

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.19.0-rc5

Description A null pointer dereference issue exists in the bpf lwt xmit push encap helper. The issue occurs because the skb-> skb refdst variable may not be initialized when the socket buffer (skb) is set up by the bpf prog test run skb() function. When the bpf lwt push ip encap() function is executed in this state, it attempts to access skb dst(skb)->dev to calculate the required headroom, leading to a kernel crash.

Recommendations As a temporary workaround, add the setting of the skb-> skb refdst variable before calling bpf test run().