CVE-2026-98382

Received Received - Intake

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices __bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A bound-only program on an offload-registered netdev can instead inherit a real offdev and match a sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs specialized for the bound driver on the target driver's xdp_buff. Running a veth-bound program on tun reads beyond tun's bare stack xdp_buff as a veth_xdp_buff. Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673) Call Trace: ... tun_build_skb (drivers/net/tun.c:1739) tun_get_user (drivers/net/tun.c:1856) tun_chr_write_iter (drivers/net/tun.c:2091) vfs_write (fs/read_write.c:595 fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Restrict non-offloaded programs to exact netdev matches and retain the shared-offdev fallback only for genuinely offloaded multi-port programs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98382

EUVD

EUVD-2026-95537

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	2b3486bc2d237ec345b3942b7be5deabf8c8fed1
Linux	Linux	2b3486bc2d237ec345b3942b7be5deabf8c8fed1
Linux	Linux	2b3486bc2d237ec345b3942b7be5deabf8c8fed1
Linux	Linux	2b3486bc2d237ec345b3942b7be5deabf8c8fed1
Linux	Linux	2b3486bc2d237ec345b3942b7be5deabf8c8fed1
Linux	Linux	6.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) subsystem where bound-only programs can incorrectly match unrelated network devices. This happens because the offload device comparison logic fails to properly validate netdev matches, allowing a program bound to one device to run on another. This can lead to memory corruption or crashes when metadata functions are executed on unintended devices.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF subsystem and may not have direct detection commands. Monitor kernel logs for general protection faults or null-ptr-deref errors in BPF-related components. Check for unusual XDP program behavior or crashes in network drivers like veth or tun.

Impact Analysis

If exploited, this vulnerability could cause system crashes (kernel panic), data corruption, or unauthorized code execution. Attackers with CAP_BPF and CAP_NET_ADMIN privileges could manipulate network traffic processing, potentially leading to denial-of-service or privilege escalation. Systems using BPF programs on network devices are most at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel issue related to BPF program execution and network device handling. Compliance impacts would depend on system configuration and usage rather than the vulnerability itself.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Restrict CAP_BPF and CAP_NET_ADMIN capabilities to trusted users. Review and update BPF program configurations to ensure proper device binding. Monitor for kernel oops or panic events related to XDP or network drivers.

Hi! I’m here to help you understand CVE-2026-98382. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70