Linux kernel BPF devmap: XDP broadcast redirect writes past a stack array when a device has many uppers

CVSS 7.8CVE-2026-23359Kernel, userspace & hypervisorcurated

Impact

get_upper_ifindexes() walked every upper device of an interface and wrote their ifindexes into a caller-supplied array without any bounds check. Callers assumed the upper count could not exceed MAX_NEST_DEV (8) and allocated excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is false - stack a modest number of macvlans on a device and the walker writes past the end of the stack buffer. A stack out-of-bounds write in the XDP redirect path is a memory-safety bug reached on the packet path, so the trigger is one packet arriving at a device with an XDP program using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. That combination is exactly how container CNIs and XDP-based load balancers do broadcast replication, and macvlan stacking is routine on GPU nodes with many pods per interface, so this is reachable on a real production configuration rather than a syzkaller-only path. The fix passes a max down to the walker and aborts the redirect with -EOVERFLOW.

Who can reach it

Requires the privileged side of the setup - loading the XDP program and creating the macvlan stack needs CAP_BPF/CAP_NET_ADMIN - but once that configuration exists, the overflow is triggered by a packet reaching the device, so the final step needs no authentication. In a cluster where a CNI or a network plugin creates the devices and attaches the program, the vulnerable state can be reached without any tenant action.

What to do

Update to a stable kernel carrying the bounds-checked get_upper_ifindexes() and reboot each node - this is core BPF/net code, not a module, and there is no runtime knob that adds the check. As an interim measure, keep the number of upper devices (macvlans) on any XDP-attached interface at or below MAX_NEST_DEV, or avoid BPF_F_BROADCAST with BPF_F_EXCLUDE_INGRESS on such interfaces. The record links only the upstream commits; no vendor advisory names a fixed release.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-23359 https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2 https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.