flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

Summary

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values. This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() returns early when a BPF flow dissector handles the packet. struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen to U16_MAX before clamping. Found by sashiko while reviewing the commit above.

Timeline

1. Oct 23, 2026, 12:19 PM UTCCVE published
2. Oct 23, 2026, 12:20 PM UTCFirst seen by cve.now
3. Oct 30, 2026, 12:40 PM UTCRecord last updated

Affected versions

• Linux Linux

  Version range not reported

• Linux Linux

  4.20

• KernelLinux

  From 4.20.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.11

References 8