CVE-2026-0799: libpcap BPF Use-After-Free Vulnerability

CVE-2026-0799 Overview

CVE-2026-0799 is an out-of-bounds read and write vulnerability [CWE-125] in the libpcap Berkeley Packet Filter (BPF) interpreter. The interpreter fails to validate the scratch memory register index (M[]) used by BPF_LD|BPF_MEM, BPF_LDX|BPF_MEM, BPF_ST, and BPF_STX instructions. The index is treated as an unsigned 32-bit integer, but the scratch memory array only holds 16 entries (BPF_MEMWORDS). A crafted filter program can cause the interpreter to read from and write to process memory well beyond the intended buffer.

Critical Impact
On 64-bit architectures, a malicious BPF filter can access up to 16 GiB of memory starting at the current stack frame. On 32-bit architectures, the entire process address space is exposed.

Affected Products

libpcap (tcpdump-group) — versions prior to the fix in commit 48e8960a
Applications embedding vulnerable libpcap versions that accept user-supplied BPF bytecode
Downstream distributions packaging affected libpcap releases

Discovery Timeline

2026-09-05 - CVE-2026-0799 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-0799

Vulnerability Analysis

The libpcap BPF interpreter executes filter programs against captured packets. Four instruction classes interact with a scratch memory array mem[BPF_MEMWORDS] where BPF_MEMWORDS equals 16. The instruction operand pc->k selects an index into this array. The interpreter previously dereferenced mem[pc->k] without bounds validation.

Because pc->k is an unsigned 32-bit value, an attacker with the ability to submit a filter program can supply an index up to 2^32-1. On 64-bit systems, indexing a 32-bit integer into a bpf_int32 array reaches roughly 16 GiB beyond the base pointer. On 32-bit systems, wraparound arithmetic exposes the entire address space. The result is arbitrary memory read via BPF_LD/BPF_LDX and arbitrary memory corruption via BPF_ST/BPF_STX.

Root Cause

The root cause is missing input validation on the k field of BPF memory-access opcodes inside bpf_filter.c. The interpreter trusted that bpf_validate() or upstream callers had already constrained the index, but that assumption fails when applications pass unvalidated bytecode directly to the interpreter.

Attack Vector

Exploitation requires local access with the ability to submit a crafted BPF filter to a privileged consumer of libpcap. The scope is changed because the vulnerable interpreter often runs in a process with elevated privileges relative to the attacker who supplies the filter. Successful exploitation yields out-of-bounds read of sensitive memory, out-of-bounds write for process state corruption, and denial of service through invalid memory access.

// Security patch in bpf_filter.c - CVE-2026-0799
// Source: https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e97bdab841aec7

		case BPF_LD|BPF_MEM:
			if (pc->k >= BPF_MEMWORDS)
				return 0;
			A = mem[pc->k];
			continue;

		case BPF_LDX|BPF_MEM:
			if (pc->k >= BPF_MEMWORDS)
				return 0;
			X = mem[pc->k];
			continue;

		case BPF_ST:
			if (pc->k >= BPF_MEMWORDS)
				return 0;
			mem[pc->k] = A;
			continue;

		case BPF_STX:
			if (pc->k >= BPF_MEMWORDS)
				return 0;
			mem[pc->k] = X;
			continue;

The patch inserts a bounds check comparing pc->k against BPF_MEMWORDS and safely aborts the filter with a return value of 0 when the index is out of range.

Detection Methods for CVE-2026-0799

Indicators of Compromise

Unexpected crashes, segmentation faults, or SIGBUS signals in processes that invoke pcap_compile() or bpf_filter()
Log entries showing packet capture tools terminating abnormally when processing user-supplied filter expressions
Anomalous memory read patterns from packet capture daemons that hold elevated privileges

Detection Strategies

Inventory installed libpcap versions across Linux, macOS, and BSD systems and flag versions predating the 48e8960a fix
Audit applications that accept BPF bytecode from lower-privilege sources, including capture daemons, IDS sensors, and container network tooling
Static analysis of BPF filter programs to reject any that reference M[k] where k >= 16

Monitoring Recommendations

Enable core dump collection on processes linking libpcap to capture evidence of exploitation attempts
Monitor for unexpected process termination of tcpdump, dumpcap, and other libpcap-dependent binaries
Forward host telemetry and crash artifacts to a centralized data lake for correlation and behavioral analysis

How to Mitigate CVE-2026-0799

Immediate Actions Required

Upgrade libpcap to a version that includes commit 48e8960a7108e9e828f9d7bdc7e97bdab841aec7 or later
Rebuild and redeploy any statically linked applications that bundle their own libpcap copy
Restrict the ability of unprivileged users to supply BPF filter expressions to privileged capture services

Patch Information

The fix is available in the tcpdump-group libpcap repository. See the GitHub libpcap Commit for the upstream patch that adds BPF_MEMWORDS bounds validation to the four affected opcodes in bpf_filter.c.

Workarounds

Validate every BPF program with bpf_validate() before execution and reject programs that reference M[k] for k >= 16
Drop capabilities such as CAP_NET_RAW and CAP_NET_ADMIN from processes that must accept untrusted filters
Isolate packet capture services in dedicated user accounts, containers, or namespaces to limit the blast radius of a successful exploit

bash

# Verify installed libpcap version and confirm the patch is applied
dpkg -l | grep libpcap        # Debian/Ubuntu
rpm -qa | grep libpcap        # RHEL/Fedora

# Rebuild libpcap from source with the fix
git clone https://github.com/the-tcpdump-group/libpcap.git
cd libpcap
git checkout 48e8960a7108e9e828f9d7bdc7e97bdab841aec7
./configure && make && sudo make install