In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject dev-bound-only programs on other devices
__bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A bound-only program on an offload-registered netdev can instead inherit a real offdev and match a sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs specialized for the bound driver on the target driver's xdp_buff. Running a veth-bound program on tun reads beyond tun's bare stack xdp_buff as a veth_xdp_buff.
Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673) Call Trace: ... tun_build_skb (drivers/net/tun.c:1739) tun_get_user (drivers/net/tun.c:1856) tun_chr_write_iter (drivers/net/tun.c:2091) vfs_write (fs/read_write.c:595 fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt
Restrict non-offloaded programs to exact netdev matches and retain the shared-offdev fallback only for genuinely offloaded multi-port programs.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade microvm-kernel6.18Upgrade kernel6.18-toolsUpgrade kernel6.18Upgrade kernel6.18-headersUpgrade kernel6.18-modules-extraUpgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel-livepatch-6.18.56-125.164Upgrade kernel6.18-develUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-debuginfoUpgrade bpftool6.18Upgrade bpftool6.18-debuginfoUpgrade kernel6.18-debuginfo-common-x86_64Upgrade python3-perf6.18Upgrade perf6.18-debuginfoUpgrade kernel6.18-tools-debuginfoUpgrade perf6.18Upgrade kernel6.18-tools-develUpgrade python3-perf6.18-debuginfo | Oct 28, 2026 | Oct 9, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Oct 20, 2026 | Oct 9, 2026 |
| Redhat_linux | — | No solution exists | Oct 13, 2026 | Oct 9, 2026 |
| Ubuntu | — | Upgrade linux-ibmUpgrade linux-riscvUpgrade linuxUpgrade linux-riscv-7.0Upgrade linux-awsUpgrade linux-oem-7.0Upgrade linux-hwe-7.0Upgrade linux-oracleUpgrade linux-gcp | Nov 3, 2026 | Oct 9, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2026 | Oct 9, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub