In the Linux kernel, the following vulnerability has been resolved:
net: Add rx_skb of kfree_skb to raw_tp_null_args[].
Yan Zhai reported a BPF prog could trigger a null-ptr-deref [0] in trace_kfree_skb if the prog does not check if rx_sk is NULL.
Commit c53795d48ee8 ("net: add rx_sk to trace_kfree_skb") added rx_sk to trace_kfree_skb, but rx_sk is optional and could be NULL.
Let's add kfree_skb to raw_tp_null_args[] to let the BPF verifier validate such a prog and prevent the issue.
Now we fail to load such a prog:
libbpf: prog 'drop': -- BEGIN PROG LOAD LOG -- 0: R1=ctx() R10=fp0 ; int BPF_PROG(drop, struct sk_buff *skb, void *location, @ kfree_skb_sk_null.bpf.c:21 0: (79) r3 = *(u64 *)(r1 +24) func 'kfree_skb' arg3 has btf_id 5253 type STRUCT 'sock' 1: R1=ctx() R3_w=trusted_ptr_or_null_sock(id=1) ; bpf_printk("sk: %d, %d\n", sk, sk->__sk_common.skc_family); @ kfree_skb_sk_null.bpf.c:24 1: (69) r4 = *(u16 *)(r3 +16) R3 invalid mem access 'trusted_ptr_or_null_' processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 -- END PROG LOAD LOG --
Note this fix requires commit 838a10bd2ebf ("bpf: Augment raw_tp arguments with PTR_MAYBE_NULL").
[0]: BUG: kernel NULL pointer dereference, address: 0000000000000010 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 PREEMPT SMP RIP: 0010:bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d Call Trace: <TASK> ? __die+0x1f/0x60 ? page_fault_oops+0x148/0x420 ? search_bpf_extables+0x5b/0x70 ? fixup_exception+0x27/0x2c0 ? exc_page_fault+0x75/0x170 ? asm_exc_page_fault+0x22/0x30 ? bpf_prog_5e21a6db8fcff1aa_drop+0x10/0x2d bpf_trace_run4+0x68/0xd0 ? unix_stream_connect+0x1f4/0x6f0 sk_skb_reason_drop+0x90/0x120 unix_stream_connect+0x1f4/0x6f0 __sys_connect+0x7f/0xb0 __x64_sys_connect+0x14/0x20 do_syscall_64+0x47/0xc30 entry_SYSCALL_64_after_hwframe+0x4b/0x53
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 12, 2025 |
| Suse | — | Upgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade dtb-broadcomUpgrade kernel-debug-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-defaultUpgrade kernel-docsUpgrade kernel-source-vanillaUpgrade dtb-sprdUpgrade kernel-64kb-extraUpgrade kernel-default-optionalUpgrade dtb-caviumUpgrade dtb-hisiliconUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade dtb-nvidiaUpgrade dtb-appleUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-rtUpgrade dtb-xilinxUpgrade ocfs2-kmp-azureUpgrade kernel-develUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-debugUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade cluster-md-kmp-64kbUpgrade dtb-renesasUpgrade kernel-azure-extraUpgrade kernel-obs-buildUpgrade kernel-rt_debugUpgrade dtb-rockchipUpgrade kernel-docs-htmlUpgrade dtb-socionextUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade kernel-default-baseUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-vdsoUpgrade dtb-alteraUpgrade dtb-amdUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-source-rtUpgrade reiserfs-kmp-azureUpgrade kernel-default-vdsoUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kernel-azure-vdsoUpgrade kernel-azure-develUpgrade kernel-64kb-optionalUpgrade dtb-amazonUpgrade cluster-md-kmp-azureUpgrade kernel-syms-rtUpgrade kselftests-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-macrosUpgrade kernel-kvmsmallUpgrade dlm-kmp-azureUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-defaultUpgrade dtb-freescaleUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatchUpgrade dtb-armUpgrade dtb-exynosUpgrade dtb-apmUpgrade dtb-qcomUpgrade dtb-amlogicUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-devel-rtUpgrade kernel-default-develUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kbUpgrade dtb-mediatekUpgrade dtb-marvellUpgrade dtb-lgUpgrade kernel-rt-livepatch-develUpgrade kernel-default-base-rebuildUpgrade kernel-symsUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-obs-qa | Dec 5, 2025 | May 21, 2025 |
| Ubuntu | — | Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-raspiUpgrade linux-image-realtimeUpgrade linux-image-6.11.0-1015-gcpUpgrade linux-image-6.11.0-1016-oracle-64kUpgrade linux-image-6.11.0-1013-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-oracleUpgrade linux-image-6.11.0-1010-realtimeUpgrade linux-image-6.11.0-1014-lowlatency-64kUpgrade linux-image-6.11.0-1016-oracleUpgrade linux-image-awsUpgrade linux-image-gcp-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1015-gcp-64kUpgrade linux-image-azureUpgrade linux-image-6.11.0-1014-lowlatencyUpgrade linux-image-oem-24.04bUpgrade linux-image-virtualUpgrade linux-image-6.11.0-1015-azureUpgrade linux-image-6.11.0-26-generic-64kUpgrade linux-image-6.11.0-1014-awsUpgrade linux-image-6.11.0-1022-oemUpgrade linux-image-generic-64kUpgrade linux-image-genericUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.11.0-1015-azure-fdeUpgrade linux-image-6.11.0-26-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency | May 21, 2025 | Mar 12, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub