CVE-2026-98966

What it actually does

Reference leak on old BPF programs in the Linux bonding driver when an XDP program is replaced or cleared, allowing leaked programs to accumulate in memory.

Why it matters to the business

Systems using network bonding with XDP may experience gradual memory growth over time, potentially leading to resource exhaustion, degraded performance, or service instability in high-uptime environments.

How an attack unfolds

An attacker or automated process repeatedly replaces or removes XDP programs on a bonded network interface, triggering the reference leak and causing program objects to accumulate without being released.

How to fix it

Update the Linux kernel to a version containing the fix for the bonding XDP program reference leak. Reboot affected systems after the update and verify XDP functionality on bonded interfaces.

How to confirm the fix worked

Confirm the kernel version includes the bonding XDP leak fix, run existing selftests for XDP program replacement on bonds, and monitor for program reference counts remaining stable after attach/detach cycles.

Typical attack path

1. Identify or create a bonded network interface configured for XDP.
2. Repeatedly attach, replace, or detach BPF/XDP programs via netlink or bpftool.
3. Observe memory growth from unreleased program references over multiple cycles.

How to detect it

Review kernel memory statistics and BPF program reference counts on systems with bonding and XDP enabled; look for steadily increasing program object counts after XDP program changes in logs or via bpftool.

What your security team should do

• Prioritize kernel updates on systems using bonding with XDP within standard patch windows.
• Monitor memory usage on bonded interfaces for unexpected growth until patched.
• Review network configurations for unnecessary XDP usage on bonds to reduce exposure surface.