In the Linux kernel, the following vulnerability has been resolved: bpf, xdp: move offload check into dev_xdp_install() bpf_xdp_link_update() calls dev_xdp_install() directly and skips dev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can make an XDP link with a normal program and then swap in an offloaded or device-bound program with BPF_LINK_UPDATE, which puts it on the software path. dev_xdp_install() is the one place all three paths go through: "ip link set xdp" and BPF_LINK_CREATE reach it via dev_xdp_attach(), and BPF_LINK_UPDATE calls it directly. So move the program checks (offloaded, bound to another device, device-bound in generic mode, native vs generic, DEVMAP and CPUMAP) there, and keep only the netlink-flag check (XDP_FLAGS_UPDATE_IF_NOEXIST) in dev_xdp_attach().
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 5
- StatusReceived → PublishedNVD modified 2026-10-21 12:50
- References+2 references (now 6)NVD modified 2026-10-21 13:20
- StatusPublished → ReceivedNVD modified 2026-10-21 13:20
- StatusReceived → PublishedNVD modified 2026-10-19 08:58
- First seenCVSS 7.8NVD modified 2026-10-15 11:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://git.kernel.org/stable/c/03022dd874070768a7099f18b1944c633641315f
- https://git.kernel.org/stable/c/486dbe7efec2be19cd3625be282f7f6b34a3f2c5
- https://git.kernel.org/stable/c/ad27ed7d2309419a129078d781504f486b1b469a
- https://git.kernel.org/stable/c/bd06033625ec20b7bdec43d21f776fc1a5e9000e
- https://git.kernel.org/stable/c/ea7b35dcc9430293b861bc7bad0c546f193c85f9
- https://git.kernel.org/stable/c/f14b774ec9bd52d0f4ec29a6597a35fd107197f9