HIGH
bpf devmap Stack Overflow
CVE-2026-23359
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-of-bounds write. Add a max parameter to get_upper_ifindexes() to avoid the issue. When there are too many upper devices, return -EOVERFLOW and abort the redirect. To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Then send a packet to the device to trigger the XDP redirect path.
02KernelScan AI Analysis
Risk summary
A local attacker with network configuration privileges can create excessive macvlan interfaces to trigger a stack buffer overflow in the BPF devmap subsystem. This could lead to kernel memory corruption, system crashes, or potential privilege escalation through stack-based exploitation techniques.
Vulnerability analysis
Root Cause: The get_upper_ifindexes() function iterates over all upper network devices and writes their interface indices into a stack-allocated array without bounds checking. Callers allocate excluded_devices[1+MAX_NEST_DEV] assuming MAX_NEST_DEV (8) is the maximum number of upper devices, but this assumption is incorrect - configurations with many macvlans can exceed this limit.
Attack Surface: Local attack surface requiring the ability to create network interfaces (macvlans) and attach XDP programs with BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS flags. The vulnerability is triggered when packets are sent to devices with more than MAX_NEST_DEV upper devices, causing stack corruption in the XDP redirect path.
Fix Mechanism: The patch adds a 'max' parameter to get_upper_ifindexes() to enforce bounds checking. When the number of upper devices exceeds the array capacity, the function returns -EOVERFLOW instead of writing past the buffer end. Callers now pass ARRAY_SIZE(excluded_devices) - 1 as the maximum and handle the overflow error by aborting the redirect operation.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.15 | 5.15.203 | 88df604f0d16 |
| 6.1 | 6.1.167 | 5000e40acc8d |
| 6.12 | 6.12.77 | d2c31d8e03d0 |
| 6.18 | 6.18.17 | 75d474702b2b |
| 6.19 | 6.19.7 | ca831567908f |
| 6.6 | 6.6.130 | 8a95fb9df110 |
| mainline | 7.0 | b7bf516c3ecd |