CVE-2026-98382 in Linux
Summary
by MITRE • 10/09/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject dev-bound-only programs on other devices
__bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A bound-only program on an offload-registered netdev can instead inherit a real offdev and match a sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs specialized for the bound driver on the target driver's xdp_buff. Running a veth-bound program on tun reads beyond tun's bare stack xdp_buff as a veth_xdp_buff.
Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673) Call Trace: ... tun_build_skb (drivers/net/tun.c:1739) tun_get_user (drivers/net/tun.c:1856) tun_chr_write_iter (drivers/net/tun.c:2091) vfs_write (fs/read_write.c:595 fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt
Restrict non-offloaded programs to exact netdev matches and retain the shared-offdev fallback only for genuinely offloaded multi-port programs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The Linux kernel contains a critical vulnerability within its Berkeley Packet Filter (BPF) subsystem, specifically affecting how device-bound eXpress Data Path (XDP) programs are matched to network interfaces during link creation. The core flaw resides in the __bpf_offload_dev_match() function, which is responsible for verifying that a BPF program attached to one network device can be correctly associated with another target interface when creating a BPF link. Under normal circumstances, this function performs an exact match of the net_device pointers to ensure strict isolation between different hardware interfaces. However, in cases where an exact mismatch occurs, the logic falls back to comparing offload device (offdev) pointers. This fallback mechanism was intended for multi-port devices that share a common offloading engine but operates incorrectly when applied to programs bound only to specific drivers without actual hardware offloading capabilities.
The technical root cause stems from the fact that dev-bound-only BPF programs typically have NULL offdev values because they do not utilize dedicated hardware offload engines. When two unrelated network interfaces, such as a veth pair and a TUN device, both possess NULL offdev pointers due to lacking true offloading support, the comparison logic erroneously treats them as equivalent or compatible for program execution contexts. This logical error allows an attacker with CAP_BPF and CAP_NET_ADMIN privileges to bypass intended isolation boundaries. By leveraging bpf(BPF_LINK_CREATE) calls, a user can attach a BPF program designed specifically for one driver's data structures onto the XDP context of a completely different target interface that has no relation to the original binding constraints.
The operational impact of this vulnerability is severe and manifests as a kernel panic resulting from memory corruption and out-of-bounds access. When an attacker successfully exploits this flaw, they can force the execution of metadata kfuncs specialized for one driver type on the xdp_buff structure of another incompatible driver. For instance, running a veth-specific XDP program on a TUN device causes the kernel to interpret the bare stack-based xdp_buff of the TUN interface using the memory layout expectations of veth_xdp_buff structures. This mismatch leads directly to invalid pointer dereferences and general protection faults, as evidenced by KASAN reports indicating null-pointer dereferences in ranges like 0x10-0x17 within functions such as veth_xdp_rx_timestamp. The resulting kernel panic halts system operation, leading to a denial of service for all processes running on the affected host.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer, as it involves both unauthorized privilege escalation through flawed access checks and subsequent memory safety violations due to incorrect type assumptions in kernel space. From an ATT&CK perspective, this represents a technique for Privilege Escalation via Kernel Exploitation, specifically leveraging improper validation of resource bindings to execute arbitrary code or cause system instability within the operating system core. The attack vector requires local access with specific capabilities, making it relevant primarily to multi-tenant environments or systems where untrusted users are granted BPF permissions without strict sandboxing policies.
To mitigate this vulnerability, kernel developers have implemented a fix that restricts non-offloaded programs to exact netdev matches exclusively. This change ensures that the shared offload device fallback logic is retained only for genuinely offloaded multi-port programs where such cross-device context sharing is valid and safe. System administrators should apply the latest available Linux kernel updates that include this patch immediately. Additionally, organizations relying on BPF capabilities should audit their capability assignments to ensure that CAP_BPF and CAP_NET_ADMIN are granted only to trusted processes with a strict need for low-level network manipulation, thereby reducing the attack surface even if similar logical flaws exist in other subsystems. Regular security audits of kernel configurations and continuous monitoring for unusual kernel panics or KASAN traces can help detect potential exploitation attempts early.