CVE-2026-90146

A flaw was found in the Linux kernel. The bpf_xdp_link_update() function bypasses necessary checks when updating an eXpress Data Path (XDP) program. A local user can first create an XDP link with a standard program and then use BPF_LINK_UPDATE to replace it with an offloaded or device-bound program. This circumvents the intended offload checks, causing the program to run on the software path instead of being properly offloaded, which could lead to unexpected behavior or resource consumption.

An XDP link update validation bypass exists because bpf_xdp_link_update calls dev_xdp_install directly and did not run the compatibility checks kept in dev_xdp_attach. A user could create an XDP link with a normal program and then replace it with an offloaded or device-bound program through BPF_LINK_UPDATE, causing a program that should be restricted to hardware offload or a specific device to be placed on the software XDP path. This is not directly network reachable by packet traffic alone, but packets may exercise the bad attachment after a local control plane update. For the CVSS the PR:L is used for the paranoid score because exploitation can be performed by a local user or service that already has delegated BPF/XDP update capability, such as CAP_BPF and CAP_NET_ADMIN or an equivalent capability in the target environment. Impact is mainly denial of service or validation policy bypass. The patch context does not show a concrete arbitrary write or information leak primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.