CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix tcx/netkit detach permissions when prog fd isn't given
This commit fixes a security issue where BPFPROGDETACH on tcx or netkit devices could be executed by any user when no program fd was provided, bypassing permission checks. The fix adds a capability check for CAPNETADMIN or CAPSYSADMIN in this case.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix that adds a capability check so BPF_PROG_DETACH on tcx/netkit detach operations verifies CAP_NET_ADMIN or CAP_SYS_ADMIN when the program file descriptor (prog fd) is not provided.
Linux kernel (BPF_PROG_DETACH on tcx/netkit) Detach permission checks for BPF program detach when prog fd isn't provided = Require CAP_NET_ADMIN or CAP_SYS_ADMIN
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user able to issue BPF_PROG_DETACH requests against tcx or netkit devices could exploit the missing permission check when no program file descriptor is supplied. The vulnerable path allowed this without the intended administrative capabilities.
What access does an attacker need?
The attack vector is local and requires low privileges; no user interaction is required. The affected operation is detaching BPF programs from tcx or netkit devices without providing a program FD.
What changes after the fix?
When no program FD is provided for BPF_PROG_DETACH on tcx or netkit devices, the kernel now requires CAP_NET_ADMIN or CAP_SYS_ADMIN. Users without either capability can no longer use that path to bypass permission checks.