Medium5.5Vendor: LowRed Hat Linux

Medium [CVE-2026-53111] Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap

This medium-severity Red Hat Linux advisory covers CVE-2026-53111 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.

CVE-2026-53111 Published Jun 24, 2026Updated by vendor Jun 24, 2026

CVE-2026-53111

Affected products & platforms

Red Hat LinuxLinux Kernel

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap The bpf_lwt_xmit_push_encap helper needs to access skb_dst(skb)->dev to calculate the needed headroom: err = skb_cow_head(skb, len + LL_RESERVED_SPACE(skb_dst(skb)->dev)); But skb->_skb_refdst may not be initialized when the skb is set up by bpf_prog_test_run_skb function.

Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.

Affected versions

< 105.186365
< 105.186382
< 105.186388
< 105.186393
< 105.186404
< 105.186412
< 6.19.0-rc5
< 105.186423
< 1.16.3-debian
< 1.16.3-2
< 105.186427
< 105.186443
< 105.186449
< 105.186455
< 105.186460
< 105.186463
< 105.186467
< 105.186471
< 105.186484
< 105.186490
< 105.186494
< 105.186499
< 105.186502
< 105.186507

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Mitigation

The source record does not include mitigation steps. That is not a statement that no fix exists — read the vendor advisory below for the authoritative guidance.

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.