The Linux kernel function bpf_prog_test_run_skb mistakenly processes packets that contain only an Ethernet header while the EtherType indicates IPv4 or IPv6. It accesses ip_hdr or ipv6_hdr structures even when the L3 header is too short, which can result in out‑of‑bounds memory reads or erroneous program validation. The patch, added in the commit referenced in the CVE, introduces an early rejection path that checks the length of the IPv4/IPv6 header and returns -EINVAL before accessing the network headers. This change prevents BPF programs from loading or executing when malformed input is supplied, causing potential service disruption rather than a crash or data leak.

All Linux kernel versions that do not yet include the commit which rejects short IPv4/IPv6 inputs are affected. The issue resides in upstream kernels maintained by the Linux kernel team; any distribution shipping an unpatched kernel falls under this risk. No specific version range is listed, so all pre‑patch releases are considered vulnerable until the fix is backported by maintainers.

The CVSS score of 5.5 indicates a medium severity. The EPSS score of less than 1% and the absence from the CISA KEV catalog suggest a low likelihood of exploitation. Based on the description, the likely attack vector involves a local or privileged process that can supply malformed packet data to bpf_prog_test_run_skb, such as a developer using a BPF test harness. Exploitation would primarily result in failure to load or run BPF programs, leading to service disruption rather than a system compromise.