Cloudanix VulnDB

CVE-2026-23359

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's networking features could let someone with access to the computer overwrite important memory and potentially take over the machine.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Stack out-of-bounds write in the Linux kernel BPF devmap implementation when get_upper_ifindexes() iterates over more than MAX_NEST_DEV upper devices without bounds checking during XDP redirect operations.

Why it matters to the business

Local attackers on affected Linux systems can achieve memory corruption leading to privilege escalation or denial of service, particularly on hosts using XDP networking with multiple virtual interfaces such as macvlans; high urgency for systems in cloud or container environments where kernel networking is exposed.

How an attack unfolds

An attacker with local access creates more than eight macvlan devices on a network interface that has an XDP program attached using BPF_F_BROADCAST and BPF_F_EXCLUDE_INGRESS flags, then transmits a packet that triggers the XDP redirect path, causing get_upper_ifindexes() to write beyond the allocated stack buffer.

How to fix it

Apply the upstream kernel patch that adds a max parameter to get_upper_ifindexes(), enforces the bound, and returns -EOVERFLOW to abort the redirect when the limit is exceeded; upgrade to a Linux kernel release containing this fix.

How to confirm the fix worked

Inspect kernel source for the updated get_upper_ifindexes() function containing the max parameter and EOVERFLOW check; reproduce the original crash scenario with more than eight macvlans and confirm the redirect is safely aborted without stack corruption.

Typical attack path

  1. Obtain local unprivileged access on a Linux host
  2. Create more than MAX_NEST_DEV macvlan or similar upper devices on a target interface
  3. Attach an XDP program configured for broadcast redirect that excludes ingress traffic
  4. Transmit a network packet to the interface to invoke the vulnerable XDP redirect code path

How to detect it

Search kernel logs and audit trails for stack traces or warnings referencing get_upper_ifindexes, devmap, or XDP redirect failures; look for creation of large numbers of macvlan interfaces followed by network activity on XDP-enabled devices.

What your security team should do

  • Prioritize kernel updates on all Linux systems that expose XDP or use multiple virtual network devices
  • Restrict unprivileged local access and container workloads on affected hosts until patched
  • Review XDP program deployments and limit the number of upper devices per interface where feasible
  • Monitor kernel update channels for the specific devmap fix and schedule rapid deployment

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-of-bounds write. Add a max parameter to get_upper_ifindexes() to avoid the issue. When there are too many upper devices, return -EOVERFLOW and abort the redirect. To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Then send a packet to the device to trigger the XDP redirect path.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities