CVE-2026-90146

bpf, xdp: move offload check into dev_xdp_install()

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, xdp: move offload check into dev_xdp_install()

bpf_xdp_link_update() calls dev_xdp_install() directly and skips dev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can make an XDP link with a normal program and then swap in an offloaded or device-bound program with BPF_LINK_UPDATE, which puts it on the software path.

dev_xdp_install() is the one place all three paths go through: "ip link set xdp" and BPF_LINK_CREATE reach it via dev_xdp_attach(), and BPF_LINK_UPDATE calls it directly. So move the program checks (offloaded, bound to another device, device-bound in generic mode, native vs generic, DEVMAP and CPUMAP) there, and keep only the netlink-flag check (XDP_FLAGS_UPDATE_IF_NOEXIST) in dev_xdp_attach().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before 4a0467819bc2423be8fc4c9834e8f42af2af0861Affected 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before bd06033625ec20b7bdec43d21f776fc1a5e9000eAffected 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before 486dbe7efec2be19cd3625be282f7f6b34a3f2c5Affected 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before f14b774ec9bd52d0f4ec29a6597a35fd107197f9Affected 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before ea7b35dcc9430293b861bc7bad0c546f193c85f9Affected 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before 03022dd874070768a7099f18b1944c633641315fAffected 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before ad27ed7d2309419a129078d781504f486b1b469aAffected
LinuxLinux	5.9Affected before 5.9Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.12.114 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before 4a0467819bc2423be8fc4c9834e8f42af2af0861Affected
026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before bd06033625ec20b7bdec43d21f776fc1a5e9000eAffected
026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before 486dbe7efec2be19cd3625be282f7f6b34a3f2c5Affected
026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before f14b774ec9bd52d0f4ec29a6597a35fd107197f9Affected
026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before ea7b35dcc9430293b861bc7bad0c546f193c85f9Affected
026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before 03022dd874070768a7099f18b1944c633641315fAffected
026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 to before ad27ed7d2309419a129078d781504f486b1b469aAffected

LinuxLinux

5.9Affected
before 5.9Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.12.114 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.