CVE-2026-98382: Linux Kernel BPF Privilege Escalation

CVE-2026-98382 Overview

CVE-2026-98382 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in __bpf_offload_dev_match(), which incorrectly allows device-bound-only BPF programs to execute on unrelated network devices. A caller with CAP_BPF and CAP_NET_ADMIN can invoke bpf(BPF_LINK_CREATE) with a different target ifindex. This causes metadata kfuncs specialized for one driver (such as veth) to run against another driver's xdp_buff (such as tun). The result is an out-of-bounds read that triggers a general protection fault and kernel panic.

Critical Impact
A local attacker holding CAP_BPF and CAP_NET_ADMIN can trigger a kernel panic through cross-device BPF metadata kfunc execution, producing a denial-of-service condition.

Affected Products

Linux kernel versions containing the vulnerable __bpf_offload_dev_match() offdev fallback logic
Systems with BPF offload-registered netdevs and veth or tun interfaces
Distributions shipping affected mainline and stable kernel branches

Discovery Timeline

2026-10-09 - CVE-2026-98382 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-98382

Vulnerability Analysis

The vulnerability stems from flawed matching logic in __bpf_offload_dev_match(). The function falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs typically carry a NULL offdev, which causes unrelated netdevs to compare as equal. A bound-only program attached to an offload-registered netdev can inherit a real offdev and match a sibling port.

When the attacker exercises this path, the kernel runs driver-specialized metadata kfuncs on a foreign driver's buffer. The included call trace shows veth_xdp_rx_timestamp executing against a tun path, reading past tun's bare stack xdp_buff as if it were a veth_xdp_buff. This is an out-of-bounds read [CWE-125] in a privileged kernel context.

Root Cause

The root cause is overly permissive equivalence in the offload device comparison. The fallback was intended to allow genuinely offloaded multi-port programs to share an offdev. However, non-offloaded bound-only programs were not excluded from the fallback. Two unrelated netdevs with NULL or shared offdev pointers therefore satisfied the match.

Attack Vector

An attacker with CAP_BPF and CAP_NET_ADMIN loads a BPF program bound to one netdev that supports metadata kfuncs. The attacker then calls bpf(BPF_LINK_CREATE) targeting a different ifindex belonging to a sibling driver. The kernel accepts the mismatched attachment, and the program's kfuncs operate on buffers whose layout differs from the bound driver's expectations. The patched commits (0dceda3, 6db1ce7, 940b626, bb375f3, e57f041) restrict non-offloaded programs to exact netdev matches and retain the shared-offdev fallback only for genuinely offloaded multi-port programs.

See the upstream fix in Kernel.org Commit 940b626 for the authoritative patch content.

Detection Methods for CVE-2026-98382

Indicators of Compromise

Kernel panic logs referencing veth_xdp_rx_timestamp or similar driver-specific XDP metadata kfuncs in unexpected call paths
KASAN null-pointer dereference reports in the range [0x0000000000000010-0x0000000000000017] originating from XDP metadata helpers
Unexpected bpf(BPF_LINK_CREATE) syscalls where the target ifindex differs from the program's bound device

Detection Strategies

Audit bpf() syscalls with the BPF_LINK_CREATE command and correlate the program's bound ifindex against the attach target ifindex
Monitor processes holding both CAP_BPF and CAP_NET_ADMIN that load device-bound XDP programs
Alert on kernel oops events whose RIP resolves to driver-specific XDP metadata functions executing from unrelated driver stacks

Monitoring Recommendations

Enable kernel audit rules for bpf syscall activity and ship logs to a centralized data lake for correlation
Collect dmesg and /var/log/kern.log output, flagging general protection faults near XDP code paths
Baseline legitimate XDP program attachments per host so cross-device attach attempts stand out

How to Mitigate CVE-2026-98382

Immediate Actions Required

Apply the stable kernel updates containing commits 0dceda3, 6db1ce7, 940b626, bb375f3, and e57f041
Reboot affected hosts after patching so the fixed kernel code path takes effect
Restrict CAP_BPF and CAP_NET_ADMIN to trusted administrators and service accounts

Patch Information

The fix enforces exact netdev matching for non-offloaded bound-only BPF programs. The shared-offdev fallback is retained only for genuinely offloaded multi-port programs. Patched commits are available at Kernel.org Commit 0dceda3, Kernel.org Commit 6db1ce7, Kernel.org Commit 940b626, Kernel.org Commit bb375f3, and Kernel.org Commit e57f041.

Workarounds

Remove CAP_BPF and CAP_NET_ADMIN from unprivileged workloads and containers until the kernel is patched
Disable loading of custom XDP programs on hosts that do not require them
Use seccomp or Landlock policies to block the bpf() syscall for workloads that do not need it

bash

# Example: drop BPF-related capabilities from a systemd unit
# /etc/systemd/system/example.service.d/override.conf
[Service]
CapabilityBoundingSet=~CAP_BPF CAP_NET_ADMIN
AmbientCapabilities=
NoNewPrivileges=yes
SystemCallFilter=~@bpf