CVE-2026-90146: bpf, xdp: move offload check into dev_xdp_install()
In the Linux kernel, the following vulnerability has been resolved:
bpf, xdp: move offload check into devxdpinstall()
bpfxdplinkupdate() calls devxdpinstall() directly and skips devxdpattach(), so the checks in devxdpattach() do not run. A user can make an XDP link with a normal program and then swap in an offloaded or device-bound program with BPFLINKUPDATE, which puts it on the software path.
devxdpinstall() is the one place all three paths go through: "ip link set xdp" and BPFLINKCREATE reach it via devxdpattach(), and BPFLINKUPDATE calls it directly. So move the program checks (offloaded, bound to another device, device-bound in generic mode, native vs generic, DEVMAP and CPUMAP) there, and keep only the netlink-flag check (XDPFLAGSUPDATEIFNOEXIST) in devxdpattach().
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs the ability to create an XDP link with a normal BPF program and then perform a BPF_LINK_UPDATE to replace it with an offloaded or device-bound program.
Which XDP configuration paths are affected by the missing checks?
The gap is specific to BPF_LINK_UPDATE, which calls dev_xdp_install() directly and bypasses checks previously performed in dev_xdp_attach(). The "ip link set xdp" and BPF_LINK_CREATE paths reach dev_xdp_install() through dev_xdp_attach().
How can I determine whether a system may be affected?
Review whether XDP links are managed through BPF_LINK_UPDATE and whether those updates can substitute offloaded, device-bound, DEVMAP, or CPUMAP programs, or change native versus generic mode. The vulnerable behavior allows a normal-program XDP link to be updated to an offloaded or device-bound program that is then placed on the software path.