CVE-2026-90146: bpf, xdp: move offload check into dev_xdp_install()
In the Linux kernel, the following vulnerability has been resolved:
bpf, xdp: move offload check into devxdpinstall()
bpfxdplinkupdate() calls devxdpinstall() directly and skips devxdpattach(), so the checks in devxdpattach() do not run. A user can make an XDP link with a normal program and then swap in an offloaded or device-bound program with BPFLINKUPDATE, which puts it on the software path.
devxdpinstall() is the one place all three paths go through: "ip link set xdp" and BPFLINKCREATE reach it via devxdpattach(), and BPFLINKUPDATE calls it directly. So move the program checks (offloaded, bound to another device, device-bound in generic mode, native vs generic, DEVMAP and CPUMAP) there, and keep only the netlink-flag check (XDPFLAGSUPDATEIFNOEXIST) in devxdpattach().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs the ability to create an XDP link with a normal BPF program and then perform a BPF_LINK_UPDATE to replace it with an offloaded or device-bound program.
Which XDP configuration paths are affected by the missing checks?
The gap is specific to BPF_LINK_UPDATE, which calls dev_xdp_install() directly and bypasses checks previously performed in dev_xdp_attach(). The "ip link set xdp" and BPF_LINK_CREATE paths reach dev_xdp_install() through dev_xdp_attach().
How can I determine whether a system may be affected?
Review whether XDP links are managed through BPF_LINK_UPDATE and whether those updates can substitute offloaded, device-bound, DEVMAP, or CPUMAP programs, or change native versus generic mode. The vulnerable behavior allows a normal-program XDP link to be updated to an offloaded or device-bound program that is then placed on the software path.