Linux kernel XDP: BPF_LINK_UPDATE bypasses offload checks, putting a device-bound program on the software path

Impact

bpf_xdp_link_update() called dev_xdp_install() directly instead of going through dev_xdp_attach(), so the checks that reject offloaded, device-bound, wrong-device, DEVMAP and CPUMAP programs never ran. A caller could create an XDP link with an ordinary program and then swap in an offloaded or device-bound program with BPF_LINK_UPDATE, running it on the generic software path it was never verified for. On GPU fleet nodes this is the data-plane path: XDP is commonly used for load balancing, DDoS filtering and RDMA-adjacent packet steering on high-rate NICs, so running a device-bound program in the wrong context can corrupt packet handling or crash the host networking stack on a node that cannot be drained cheaply. NVD scores it local, low complexity, high across confidentiality, integrity and availability.

Who can reach it

Local user with the capability to create and update BPF links on the host network namespace (effectively CAP_BPF/CAP_NET_ADMIN or root). Not reachable from an unprivileged tenant pod unless the pod has been granted those capabilities.

What to do

Apply the stable kernel update that moves the program checks into dev_xdp_install() (commits 03022dd87407, 486dbe7efec2, ad27ed7d2309, ea7b35dcc943) and reboot each node; the fix is in built-in core networking code with no module-reload or live-patch option in the record. Until then, do not grant CAP_BPF or CAP_NET_ADMIN on the host network namespace to workloads. No fixed release numbers are given in the record.

References

Related entries

• Linux kernel BPF verifier (atomic RMW destination pointer type tracking): The verifier recorded an instruction'sCVE-2026-90177 · Linux kernel BPF verifier (atomic RMW destination pointer type tracking)High
• Linux kernel BPF: use-after-free when multi-attach trampoline update fails and the still-live old image is freedCVE-2026-90210 · Linux kernel BPF trampoline (bpf_trampoline_multi_attach_free on update failure)High
• Linux kernel BPF verifier: iterator stack slots compared without pointer type, pruning an unsafe pathCVE-2026-90217 · Linux kernel BPF verifier (STACK_ITER slot type comparison during state pruning)High
• Linux kernel NVMe: SUBMIT_IO skips the command permission check, allowing writes through read-only handlesCVE-2026-90227 · Linux kernel NVMe ioctl (NVME_IOCTL_SUBMIT_IO missing nvme_cmd_allowed() check)High
• Linux kernel IOMMU DMA: unlocked msi_page_list corruption with two devices in one VFIO containerCVE-2026-90244 · Linux kernel iommu/dma (MSI page list locking under VFIO type1)High
• Linux kernel RDMA/siw: use-after-free in siw_accept() when the supplied QP is already in RTSCVE-2026-90292 · Linux kernel RDMA/siw (software iWARP, siw_accept() connection endpoint refcount)High