HIGH Introduced in 5.9
bpf XdpLink Bypass
CVE-2026-90146
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bpf, xdp: move offload check into dev_xdp_install() bpf_xdp_link_update() calls dev_xdp_install() directly and skips dev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can make an XDP link with a normal program and then swap in an offloaded or device-bound program with BPF_LINK_UPDATE, which puts it on the software path. dev_xdp_install() is the one place all three paths go through: "ip link set xdp" and BPF_LINK_CREATE reach it via dev_xdp_attach(), and BPF_LINK_UPDATE calls it directly. So move the program checks (offloaded, bound to another device, device-bound in generic mode, native vs generic, DEVMAP and CPUMAP) there, and keep only the netlink-flag check (XDP_FLAGS_UPDATE_IF_NOEXIST) in dev_xdp_attach().
02KernelScan AI Analysis
Risk summary
An unprivileged local user who can obtain BPF and network administration capabilities through user namespaces can bypass XDP program validation checks via the BPF link update path, potentially running a BPF program in an unintended execution mode. This could lead to kernel memory corruption or a system crash. Systems that restrict user namespaces or unprivileged BPF are not affected.
Vulnerability analysis
A local user who can load BPF programs can create an XDP link with a normal program and then use the link update command to swap in a program that was intended for hardware offload or bound to a different device, bypassing the validation checks that normally reject such combinations. The fix moves all program compatibility checks into the shared installation function that every XDP attachment path calls, so the link update path can no longer skip them. The attack requires local access with BPF and network administration capabilities, which on many systems an unprivileged user can obtain through user namespaces.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 5.9 | 7.3-rc1 | ad27ed7d2309 |
| 7.2 | 5.9 | 7.2.6 | 03022dd87407 |
| 6.18 | 5.9 | 6.18.52 | ea7b35dcc943 |