Cloudanix VulnDB

CVE-2026-98382

None

CVSS

—

EPSS

0.2%

Published

Oct 9, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's networking tools lets certain privileged programs run on the wrong network device and crash the whole system.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows a BPF program bound to one network device (with NULL offdev) to match and attach to a sibling or unrelated netdev via __bpf_offload_dev_match fallback logic, enabling execution of driver-specialized metadata kfuncs on an incompatible xdp_buff and causing out-of-bounds reads or null pointer dereferences during packet processing.

Why it matters to the business

Systems relying on BPF for networking can experience kernel crashes and panics triggered by privileged local processes, resulting in denial of service and potential loss of network connectivity or system availability.

How an attack unfolds

An attacker with CAP_BPF and CAP_NET_ADMIN creates a dev-bound-only BPF program on an offload-registered netdev, then invokes bpf(BPF_LINK_CREATE) targeting a different ifindex; packet handling on the target device (such as tun) invokes veth-specific functions on a bare xdp_buff, triggering the fault and panic.

How to fix it

Apply the upstream kernel patch that enforces exact netdev matching for non-offloaded programs and retains the shared-offdev fallback only for genuinely offloaded multi-port devices; upgrade to a patched mainline or distribution kernel once available.

How to confirm the fix worked

Confirm the fix by inspecting the updated __bpf_offload_dev_match implementation for strict netdev pointer equality checks on bound-only programs, and test attachment attempts across unrelated netdevs to verify rejection.

Typical attack path

  1. Acquire CAP_BPF and CAP_NET_ADMIN capabilities
  2. Load a dev-bound-only BPF program on an offload-registered netdev
  3. Call bpf(BPF_LINK_CREATE) specifying a mismatched target ifindex
  4. Trigger network packet processing on the target device to execute mismatched kfuncs

How to detect it

Review kernel logs and crash dumps for oops messages containing veth_xdp_rx_timestamp, tun_build_skb, or tun_get_user in the call trace, along with general protection faults or null-ptr-deref KASAN reports immediately following BPF link creation operations on network devices.

  • veth_xdp_rx_timestamp
  • tun_build_skb
  • tun_get_user
  • general protection fault
  • KASAN: null-ptr-deref
  • Kernel panic - not syncing: Fatal exception in interrupt

What your security team should do

  • Expedite deployment of patched kernels on systems exposing BPF networking interfaces
  • Limit use of CAP_BPF and CAP_NET_ADMIN to trusted processes only
  • Harden BPF program loading policies to restrict device binding where feasible
  • Monitor kernel logs for related oops and panic events during the patching window

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices __bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A bound-only program on an offload-registered netdev can instead inherit a real offdev and match a sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs specialized for the bound driver on the target driver's xdp_buff. Running a veth-bound program on tun reads beyond tun's bare stack xdp_buff as a veth_xdp_buff. Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673) Call Trace: ... tun_build_skb (drivers/net/tun.c:1739) tun_get_user (drivers/net/tun.c:1856) tun_chr_write_iter (drivers/net/tun.c:2091) vfs_write (fs/read_write.c:595 fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Restrict non-offloaded programs to exact netdev matches and retain the shared-offdev fallback only for genuinely offloaded multi-port programs.

Affected packages

Ecosystem Package Introduced Fixed