Linux BPF: dev-bound-only program can attach to a sibling netdev and run driver-specific kfuncs

Impact

__bpf_offload_dev_match() fell back to comparing offdev pointers after an exact netdev mismatch, so a device-bound-only program attached on an offload-registered netdev could inherit a real offdev and be accepted on a sibling port. That lets a caller attach a program compiled against one driver's metadata layout to a different driver, where its metadata kfuncs reinterpret that driver's xdp_buff - the reported case runs a veth-bound program on tun and dereferences tun's bare stack xdp_buff as a veth_xdp_buff, giving a general protection fault in interrupt context and a fatal kernel panic. Type-confused reads over driver-private structures are the kind of primitive that does not stay a crash for long. GPU nodes with SR-IOV or offload-capable NICs are exactly the hosts that register offload devices.

Who can reach it

Local, and privileged: the reported path needs CAP_BPF and CAP_NET_ADMIN to call bpf(BPF_LINK_CREATE) with a different target ifindex. Reachable by host-level agents and by any container deliberately given those capabilities plus the host network namespace; not reachable by a standard unprivileged GPU pod.

What to do

Update to a stable kernel carrying the fix (commits in the record) - drain and reboot each node. In the meantime, remove CAP_NET_ADMIN and CAP_BPF from workloads that do not need them, and keep hostNetwork plus those capabilities restricted to CNI and observability components you control.

References

Related entries

• Linux BPF: LWT_SEG6LOCAL program can leave a dangling SRH pointer via bpf_skb_pull_data()CVE-2026-98383 · Linux kernel BPF LWT_SEG6LOCAL (bpf_skb_pull_data with cached SRH)Unscored
• Linux BPF: bpf_sock_destroy() reads sk_protocol out of bounds on timewait and request socketsCVE-2026-98384 · Linux kernel bpf_sock_destroy() (sk_protocol read on timewait/request socks)Unscored
• Linux kernel sched/cache: use-after-free on mm_struct when a task switches address space during account_mm_sched()CVE-2026-98385 · Linux kernel scheduler (sched/cache, sched_cache_stat in mm_struct)Unscored
• ProFTPD mod_copy: unauthenticated SITE CPFR/CPTO gives arbitrary file read and writeCVE-2015-3306 · ProFTPD mod_copy (SITE CPFR / SITE CPTO)Critical
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical