CVE-2026-98382: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98382 is a Linux kernel vulnerability in the BPF subsystem where __bpf_offload_dev_match() incorrectly compares offdev pointers when handling device-bound BPF programs, allowing a bound-only program to match unrelated network devices. The flaw was introduced at commit 2b3486bc2d23 and affects Linux kernel versions starting from 6.3. Fixed versions include 6.6.158, 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5. It was published on October 9, 2026, with a CVSS category estimate of Medium (Github Advisory, Feedly).

The root cause is an improper pointer comparison in __bpf_offload_dev_match(): when an exact netdev match fails, the function falls back to comparing offdev pointers. Bound-only programs normally have NULL offdev pointers, causing unrelated netdevs to compare as equal. A bound-only program on an offload-registered netdev can inherit a real offdev and match a sibling port. With CAP_BPF and CAP_NET_ADMIN privileges, an attacker can invoke bpf(BPF_LINK_CREATE) with a different target ifindex, causing a veth-bound program to execute on a tun device — reading beyond tun's bare stack xdp_buff as a veth_xdp_buff, triggering an out-of-bounds memory access and kernel panic (KASAN null-ptr-deref at veth_xdp_rx_timestamp) (Github Advisory). The fix restricts non-offloaded programs to exact netdev matches, retaining the shared-offdev fallback only for genuinely offloaded multi-port programs.

Successful exploitation causes an out-of-bounds memory read and kernel panic, resulting in a full system crash (Denial of Service). The vulnerability is locally exploitable by a user with CAP_BPF and CAP_NET_ADMIN capabilities, limiting its scope to privileged local attackers. There is no evidence of confidentiality or integrity impact beyond the kernel crash itself (Github Advisory, Feedly).

No public proof-of-concept exploit code exists, and there is no evidence of in-the-wild exploitation as of the publication date (Github Advisory). The vulnerability requires local access with CAP_BPF and CAP_NET_ADMIN capabilities, significantly limiting the attacker pool. The EPSS score is approximately 0.156% (4th percentile), indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Privilege Acquisition: Obtain a local account with CAP_BPF and CAP_NET_ADMIN capabilities on a vulnerable Linux kernel (version ≥ 6.3, < fixed versions).
2. Setup Network Devices: Create or identify two network devices — one offload-registered (e.g., veth) and one non-offloaded (e.g., tun) — on the target system.
3. Load Bound BPF Program: Load a BPF XDP program bound to the veth device using bpf(BPF_PROG_LOAD), ensuring it uses metadata kfuncs specialized for the veth driver (e.g., veth_xdp_rx_timestamp).
4. Exploit Device Mismatch: Call bpf(BPF_LINK_CREATE) specifying the tun device's ifindex as the target, exploiting the flawed __bpf_offload_dev_match() comparison to attach the veth-bound program to the tun device.
5. Trigger Out-of-Bounds Read: Write data to the tun device (e.g., via write() syscall), causing the veth-bound program to execute against tun's smaller xdp_buff structure, reading beyond its bounds and triggering a kernel panic (Github Advisory).

• Logs: Kernel logs (dmesg) showing Oops: general protection fault or KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] with RIP: veth_xdp_rx_timestamp; call traces involving tun_build_skb, tun_get_user, tun_chr_write_iter.
• Logs: Kernel panic messages: Kernel panic - not syncing: Fatal exception in interrupt following BPF-related activity.
• Process: Unusual use of bpf() syscall with BPF_LINK_CREATE targeting a different ifindex than the program's bound device, observable via strace or eBPF-based syscall auditing.
• Network: Unexpected XDP program attachments on tun or other non-offloaded devices when veth-bound programs are present, detectable via ip link show or bpftool net show.

Upgrade to a patched Linux kernel version: 6.6.158, 6.12.112, 6.18.55, 7.2.9, or 7.3-rc5 and later (Github Advisory). As a workaround, restrict CAP_BPF and CAP_NET_ADMIN capabilities to only trusted users and processes using Linux capability controls or seccomp policies. If BPF program offloading is not required in your environment, consider disabling it entirely to reduce attack surface.