CVE-2026-98382

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject dev-bound-only programs on other devices

__bpf_offload_dev_match() falls back to comparing offdev pointers after an

exact netdev mismatch. Bound-only programs normally have NULL offdevs, so

unrelated netdevs compare equal. A bound-only program on an

offload-registered netdev can instead inherit a real offdev and match a

sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use

bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs

specialized for the bound driver on the target driver's xdp_buff. Running a

veth-bound program on tun reads beyond tun's bare stack xdp_buff as a

veth_xdp_buff.

Oops: general protection fault, probably for non-canonical address

KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]

RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)

Call Trace:

...

tun_build_skb (drivers/net/tun.c:1739)

tun_get_user (drivers/net/t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References