---
id: CVE-2022-50253
title: 'bpf: make sure skb->len != 0 when redirecting to a tunneling device'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: make sure skb->len != 0 when redirecting to a tunneling device

  syzkaller managed to trigger another case where skb->len == 0
  when we enter __dev_queue_xmit:

  WARN…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d <
    ffbccc5fb0a67424e12f7f8da210c04c8063f797
  - >-
    Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d <
    e6a63203e5a90a39392fa1a7ffc60f5e9baf642a
  - >-
    Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d <
    772431f30ca040cfbf31b791d468bac6a9ca74d3
  - >-
    Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d <
    6d935a02658be82585ecb39aab339faa84496650
  - >-
    Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d <
    5d3f4478d22b2cb1810f6fe0f797411e9d87b3e5
  - >-
    Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d <
    1b65704b8c08ae92db29f720d3b298031131da53
  - >-
    Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d <
    f186303845a01cc7e991f9dc51d7e5a3cdc7aedb
  - >-
    Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d <
    07ec7b502800ba9f7b8b15cb01dd6556bb41aaca
  - Linux 4.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:07:59.397162Z'
published: '2025-09-15'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:10:31.418Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50253'
references:
  - url: 'https://git.kernel.org/stable/c/ffbccc5fb0a67424e12f7f8da210c04c8063f797'
  - url: 'https://git.kernel.org/stable/c/e6a63203e5a90a39392fa1a7ffc60f5e9baf642a'
  - url: 'https://git.kernel.org/stable/c/772431f30ca040cfbf31b791d468bac6a9ca74d3'
  - url: 'https://git.kernel.org/stable/c/6d935a02658be82585ecb39aab339faa84496650'
  - url: 'https://git.kernel.org/stable/c/5d3f4478d22b2cb1810f6fe0f797411e9d87b3e5'
  - url: 'https://git.kernel.org/stable/c/1b65704b8c08ae92db29f720d3b298031131da53'
  - url: 'https://git.kernel.org/stable/c/f186303845a01cc7e991f9dc51d7e5a3cdc7aedb'
  - url: 'https://git.kernel.org/stable/c/07ec7b502800ba9f7b8b15cb01dd6556bb41aaca'
tags:
  - cve.org
epss: 0.00161
epssPercentile: 0.05313
ingestedAt: '2026-11-05T22:38:31.714Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: make sure skb->len != 0 when redirecting to a tunneling device

syzkaller managed to trigger another case where skb->len == 0
when we enter __dev_queue_xmit:

WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 skb_assert_len include/linux/skbuff.h:2576 [inline]
WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 __dev_queue_xmit+0x2069/0x35e0 net/core/dev.c:4295

Call Trace:
 dev_queue_xmit+0x17/0x20 net/core/dev.c:4406
 __bpf_tx_skb net/core/filter.c:2115 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2140 [inline]
 __bpf_redirect+0x5fb/0xda0 net/core/filter.c:2163
 ____bpf_clone_redirect net/core/filter.c:2447 [inline]
 bpf_clone_redirect+0x247/0x390 net/core/filter.c:2419
 bpf_prog_48159a89cb4a9a16+0x59/0x5e
 bpf_dispatcher_nop_func include/linux/bpf.h:897 [inline]
 __bpf_prog_run include/linux/filter.h:596 [inline]
 bpf_prog_run include/linux/filter.h:603 [inline]
 bpf_test_run+0x46c/0x890 net/bpf/test_run.c:402
 bpf_prog_test_run_skb+0xbdc/0x14c0 net/bpf/test_run.c:1170
 bpf_prog_test_run+0x345/0x3c0 kernel/bpf/syscall.c:3648
 __sys_bpf+0x43a/0x6c0 kernel/bpf/syscall.c:5005
 __do_sys_bpf kernel/bpf/syscall.c:5091 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5089 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5089
 do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48
 entry_SYSCALL_64_after_hwframe+0x61/0xc6

The reproducer doesn't really reproduce outside of syzkaller
environment, so I'm taking a guess here. It looks like we
do generate correct ETH_HLEN-sized packet, but we redirect
the packet to the tunneling device. Before we do so, we
__skb_pull l2 header and arrive again at skb->len == 0.
Doesn't seem like we can do anything better than having
an explicit check after __skb_pull?

## Affected

- `Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d < ffbccc5fb0a67424e12f7f8da210c04c8063f797`
- `Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d < e6a63203e5a90a39392fa1a7ffc60f5e9baf642a`
- `Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d < 772431f30ca040cfbf31b791d468bac6a9ca74d3`
- `Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d < 6d935a02658be82585ecb39aab339faa84496650`
- `Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d < 5d3f4478d22b2cb1810f6fe0f797411e9d87b3e5`
- `Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d < 1b65704b8c08ae92db29f720d3b298031131da53`
- `Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d < f186303845a01cc7e991f9dc51d7e5a3cdc7aedb`
- `Linux >= 4e3264d21b90984c2165e8fe5a7b64cf25bc2c2d < 07ec7b502800ba9f7b8b15cb01dd6556bb41aaca`
- `Linux 4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.