CVE-2026-98382

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. This vulnerability allows a privileged local user to cause a Denial of Service (DoS) by triggering an out-of-bounds memory read. When handling device-bound programs, improper validation allows a program intended for one network device to attach to an incompatible device. This mismatch causes driver-specific functions to read memory beyond allocated buffer boundaries, resulting in a kernel panic and system crash.

A device matching logic error in __bpf_offload_dev_match can allow a device bound XDP program to be attached to a different network device. Driver specific metadata kfuncs may then interpret the target driver xdp_buff as a larger and incompatible private structure. The demonstrated veth to tun combination reads beyond the actual tun xdp_buff and causes a general protection fault followed by a kernel panic. For the CVSS the PR:L in the paranoid score reflects that CAP_BPF and CAP_NET_ADMIN may be delegated to a constrained service or container root without granting complete host administration. The base assessment uses PR:H because both capabilities are normally restricted and provide substantial control over BPF and networking. The issue is locally triggered through BPF_LINK_CREATE and is not directly network reachable. Impact is at least denial of service through a kernel panic. A limited confidentiality impact is plausible because a driver metadata kfunc can read fields beyond an incompatible object and may return the resulting value to the BPF program. Integrity impact is not assigned because no UAF OOB write or arbitrary write primitive is established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.