CVE-2026-98966 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix the program leak when XDP is replaced
We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another.
Spotted by AI while running tests for the propagation series (leaked programs were accumulating). Selftest will come in the net-next series to avoid conflicts.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel bonding driver contains a resource management flaw related to eXpress Data Path XDP program attachment that results in memory leaks and potential system instability under specific configuration changes. This vulnerability occurs when an existing BPF program attached via XDP is replaced by another valid BPF program or removed entirely to revert to no-program mode. In these scenarios, the kernel fails to properly release the reference count on the previously active BPF program object. While the new program may be correctly initialized and attached, the old program remains in memory with an unreleased reference, preventing its cleanup routines from executing and freeing associated resources.
This issue stems from a logic error within the bonding driver's XDP attachment path where the conditional branches for replacing or removing a program do not invoke the necessary kernel API to decrement the BPF program reference count. The flaw was identified during automated testing of propagation series updates, where accumulated leaked programs were observed over time. Such leaks are particularly dangerous in long-running systems because they consume kernel memory continuously without bound until system resources are exhausted. Although this is technically a resource leak rather than an immediate privilege escalation vector, the accumulation of unreleased BPF program structures can lead to increased memory pressure and potentially trigger out-of-memory conditions or degrade network performance due to fragmented kernel heap usage.
From a classification perspective, this vulnerability aligns with CWE-401 Missing Release of Resource after Effective Lifetime which describes failures in releasing allocated resources such as memory or file handles when they are no longer needed. In the context of ATT&CK techniques, while not directly exploitable for initial access or persistence by an external attacker without prior code execution capabilities, it represents a weakness that could be leveraged in conjunction with other vulnerabilities to cause denial of service through resource exhaustion if an adversary can trigger repeated XDP program replacements on a bonded interface. The impact is primarily confined to the local system's stability and performance rather than data confidentiality or integrity directly.
Mitigation for this issue involves applying the upstream kernel patch that corrects the reference counting logic in the bonding driver. System administrators should ensure their Linux kernels are updated to versions where this fix has been merged into stable releases. For environments running custom or older kernels, manual verification of XDP attachment scripts and monitoring of memory usage patterns related to BPF programs can help detect early signs of leakage until an official patch is available. Regular auditing of kernel module behavior during network configuration changes is recommended to identify similar resource management oversights in other subsystems that interact with eBPF infrastructure.