The Linux kernel test harness for BPF programs, bpf_prog_test_run_skb, erroneously uses the packet's Ethertype to access L3 headers even when the supplied test input contains only an Ethernet header. This can cause an out‑of‑bounds read of the raw socket buffer, potentially leading to a kernel panic and a denial‑of‑service situation, and could be leveraged for privilege escalation if the attacker can run BPF programs.

All Linux kernel versions that have not yet integrated the commit that rejects short IPv4/IPv6 inputs are affected. The bug is present in the upstream kernel and any distribution using an unpatched kernel should be considered at risk. No specific version range is listed, so the default assumption is any pre‑patch release. The vendor is the Linux kernel maintainers.

The vulnerability is scored with no EPSS data and is not listed in the CISA KEV catalog, suggesting limited known exploitation. The failure mode is a read past the end of an Ethernet frame, an out‑of‑bounds read that can trigger a kernel fault. Attack vectors are inferred to be local or remote depending on whether an attacker can load and execute BPF programs; the test harness is part of the kernel's BPF subsystem, implying that exploitation requires BPF program execution privileges. The CVSS score is not provided, so the severity assessment must rely on the impact of a kernel panic and the exploitability described above.