CVE-2026-23359

A flaw was found in the Linux kernel. The get_upper_ifindexes() function, which collects network device indices, fails to check array boundaries when writing these indices. This allows a local attacker to create a large number of virtual network interfaces (macvlans), causing a stack-out-of-bounds write. The consequence is a denial of service (DoS), as the system aborts network packet redirection, affecting network availability.

This flaw affects systems using XDP (eXpress Data Path) with BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS on devices with many upper interfaces (>8 macvlans). The stack buffer overflow occurs because MAX_NEST_DEV assumption doesn't hold for all configurations. Requires ability to create many macvlan interfaces and attach XDP programs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.