CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given
bpf: Fix tcx/netkit detach permissions when prog fd isn't given
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix that adds a capability check so BPF_PROG_DETACH on tcx/netkit detach operations verifies CAP_NET_ADMIN or CAP_SYS_ADMIN when the program file descriptor (prog fd) is not provided.
Linux kernel (BPF_PROG_DETACH on tcx/netkit) Detach permission checks for BPF program detach when prog fd isn't provided = Require CAP_NET_ADMIN or CAP_SYS_ADMIN
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user able to issue BPF_PROG_DETACH requests against tcx or netkit devices could exploit the missing permission check when no program file descriptor is supplied. The vulnerable path allowed this without the intended administrative capabilities.
What access does an attacker need?
The attack vector is local and requires low privileges; no user interaction is required. The affected operation is detaching BPF programs from tcx or netkit devices without providing a program FD.
What changes after the fix?
When no program FD is provided for BPF_PROG_DETACH on tcx or netkit devices, the kernel now requires CAP_NET_ADMIN or CAP_SYS_ADMIN. Users without either capability can no longer use that path to bypass permission checks.