CVE-2026-98382: bpf: Reject dev-bound-only programs on other devices
bpf: Reject dev-bound-only programs on other devices
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Restrict non-offloaded programs to exact netdev matches, and retain the shared-offdev fallback only for genuinely offloaded multi-port programs.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a caller with both CAP_BPF and CAP_NET_ADMIN. The caller must be able to create a BPF link using BPF_LINK_CREATE and specify a different target interface index.
What configurations are exposed?
The issue involves device-bound-only BPF programs on an offload-registered network device that can incorrectly match a sibling port. The described crash occurs when a veth-bound program is run against a tun device, causing driver-specific metadata handling to interpret tun's xdp_buff as a veth_xdp_buff.
What is the likely impact?
The described outcome is a kernel fault, including a general protection fault and KASAN null-pointer dereference, when the mismatched program accesses device-specific XDP metadata. This indicates a local denial-of-service condition through a kernel crash.