CVE-2026-98382

bpf: Reject dev-bound-only programs on other devices

State: Published
Severity: 7.8 High
Published: Oct 9, 2026
Updated: Oct 24, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject dev-bound-only programs on other devices

__bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A bound-only program on an offload-registered netdev can instead inherit a real offdev and match a sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs specialized for the bound driver on the target driver's xdp_buff. Running a veth-bound program on tun reads beyond tun's bare stack xdp_buff as a veth_xdp_buff.

Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673) Call Trace: ... tun_build_skb (drivers/net/tun.c:1739) tun_get_user (drivers/net/tun.c:1856) tun_chr_write_iter (drivers/net/tun.c:2091) vfs_write (fs/read_write.c:595 fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt

Restrict non-offloaded programs to exact netdev matches and retain the shared-offdev fallback only for genuinely offloaded multi-port programs.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before e57f04194361574493e3e6cf0b9e9c69e4ae9791Affected 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before 0dceda331180617aeeb22381e8480b37f18ba08bAffected 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before 940b626854de200e6187777d42114727daca617cAffected 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before bb375f3c5990e29851894f20ebc4b9dbc6676126Affected 2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before 6db1ce73e9853f533eb7f413f14ba00f8ec6f80dAffected
LinuxLinux	6.3Affected before 6.3Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before e57f04194361574493e3e6cf0b9e9c69e4ae9791Affected
2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before 0dceda331180617aeeb22381e8480b37f18ba08bAffected
2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before 940b626854de200e6187777d42114727daca617cAffected
2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before bb375f3c5990e29851894f20ebc4b9dbc6676126Affected
2b3486bc2d237ec345b3942b7be5deabf8c8fed1 to before 6db1ce73e9853f533eb7f413f14ba00f8ec6f80dAffected

LinuxLinux

6.3Affected
before 6.3Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.