In the Linux kernel, the following vulnerability has been resolved:
bpf: make sure skb->len != 0 when redirecting to a tunneling device
syzkaller managed to trigger another case where skb->len == 0 when we enter __dev_queue_xmit:
WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 skb_assert_len include/linux/skbuff.h:2576 [inline] WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 __dev_queue_xmit+0x2069/0x35e0 net/core/dev.c:4295
Call Trace: dev_queue_xmit+0x17/0x20 net/core/dev.c:4406 __bpf_tx_skb net/core/filter.c:2115 [inline] __bpf_redirect_no_mac net/core/filter.c:2140 [inline] __bpf_redirect+0x5fb/0xda0 net/core/filter.c:2163 ____bpf_clone_redirect net/core/filter.c:2447 [inline] bpf_clone_redirect+0x247/0x390 net/core/filter.c:2419 bpf_prog_48159a89cb4a9a16+0x59/0x5e bpf_dispatcher_nop_func include/linux/bpf.h:897 [inline] __bpf_prog_run include/linux/filter.h:596 [inline] bpf_prog_run include/linux/filter.h:603 [inline] bpf_test_run+0x46c/0x890 net/bpf/test_run.c:402 bpf_prog_test_run_skb+0xbdc/0x14c0 net/bpf/test_run.c:1170 bpf_prog_test_run+0x345/0x3c0 kernel/bpf/syscall.c:3648 __sys_bpf+0x43a/0x6c0 kernel/bpf/syscall.c:5005 __do_sys_bpf kernel/bpf/syscall.c:5091 [inline] __se_sys_bpf kernel/bpf/syscall.c:5089 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5089 do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48 entry_SYSCALL_64_after_hwframe+0x61/0xc6
The reproducer doesn't really reproduce outside of syzkaller environment, so I'm taking a guess here. It looks like we do generate correct ETH_HLEN-sized packet, but we redirect the packet to the tunneling device. Before we do so, we __skb_pull l2 header and arrive again at skb->len == 0. Doesn't seem like we can do anything better than having an explicit check after __skb_pull?
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.86-53.137Upgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debuginfoUpgrade perfUpgrade python-perf-debuginfoUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-livepatch-5.10.165-143.735Upgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-livepatch-4.14.304-226.531Upgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Sep 17, 2025 | Sep 17, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftool | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 15, 2025 |
| Ubuntu | — | Upgrade linux-azure-4.15Upgrade linux-azureUpgrade linux-azure-fde-5.15Upgrade linux-hwe-5.4Upgrade linux-oracleUpgrade linux-azure-fipsUpgrade linux-xilinx-zynqmpUpgrade linux-azure-5.15Upgrade linux-intel-iotgUpgrade linux-kvmUpgrade linux-aws-fipsUpgrade linux-gcp-5.15Upgrade linux-oracle-5.15Upgrade linux-azure-5.4Upgrade linux-nvidiaUpgrade linux-iotUpgrade linux-ibmUpgrade linux-realtimeUpgrade linux-hwe-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-gcp-4.15Upgrade linux-intel-iotg-5.15Upgrade linux-gcp-5.4Upgrade linux-gcp-fipsUpgrade linux-hweUpgrade linux-gkeopUpgrade linux-aws-5.15Upgrade linux-riscv-5.15Upgrade linux-aws-hweUpgrade linux-bluefieldUpgrade linux-gcpUpgrade linux-lowlatency-hwe-5.15Upgrade linux-lowlatencyUpgrade linuxUpgrade linux-fipsUpgrade linux-gkeUpgrade linux-oracle-5.4Upgrade linux-aws-5.4Upgrade linux-raspi-5.4Upgrade linux-awsUpgrade linux-nvidia-tegra-5.15Upgrade linux-ibm-5.4Upgrade linux-raspi | Sep 19, 2025 | Sep 16, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub