« Volver al listado

CVE-2026-98382

Estado: RecibidaSin puntuar—

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:

bpf: Rechazar programas ligados solo a dispositivo en otros dispositivos

__bpf_offload_dev_match() recurre a comparar punteros offdev después de un desajuste exacto de netdev. Los programas ligados solo normalmente tienen offdevs NULL, por lo que netdevs no relacionados se comparan como iguales. Un programa ligado solo en un netdev registrado para descarga puede, en su lugar, heredar un offdev real y coincidir con un puerto hermano.

Leer descripción completaMostrar menos

Con CAP_BPF y CAP_NET_ADMIN, un llamador puede usar bpf(BPF_LINK_CREATE) con un ifindex de destino diferente para ejecutar kfuncs de metadatos especializados para el controlador ligado en el xdp_buff del controlador de destino. Ejecutar un programa ligado a veth en tun lee más allá del bare stack xdp_buff de tun como un veth_xdp_buff.

Se restringe los programas no descargados a coincidencias exactas de netdev y se retiene la alternativa offdev compartido solo para programas multi-puerto genuinamente descargados.

Detalles técnicos trazas, registros y código del informe original
  Oops: general protection fault, probably for non-canonical address
  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
  Call Trace:
   ...
   tun_build_skb (drivers/net/tun.c:1739)
   tun_get_user (drivers/net/tun.c:1856)
   tun_chr_write_iter (drivers/net/tun.c:2091)
   vfs_write (fs/read_write.c:595 fs/read_write.c:687)
   ksys_write (fs/read_write.c:739)
   do_syscall_64 (arch/x86/entry/syscall_64.c:84)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
  Kernel panic - not syncing: Fatal exception in interrupt

Traducción automática del texto original de NVD (en inglés).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98382",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "lessThan": "e57f04194361574493e3e6cf0b9e9c69e4ae9791",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "lessThan": "0dceda331180617aeeb22381e8480b37f18ba08b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "lessThan": "940b626854de200e6187777d42114727daca617c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "lessThan": "bb375f3c5990e29851894f20ebc4b9dbc6676126",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "lessThan": "6db1ce73e9853f533eb7f413f14ba00f8ec6f80d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/bpf/offload.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc5",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/bpf/offload.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-09T08:16:56.680",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0dceda331180617aeeb22381e8480b37f18ba08b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6db1ce73e9853f533eb7f413f14ba00f8ec6f80d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/940b626854de200e6187777d42114727daca617c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bb375f3c5990e29851894f20ebc4b9dbc6676126",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e57f04194361574493e3e6cf0b9e9c69e4ae9791",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject dev-bound-only programs on other devices\n\n__bpf_offload_dev_match() falls back to comparing offdev pointers after an\nexact netdev mismatch. Bound-only programs normally have NULL offdevs, so\nunrelated netdevs compare equal. A bound-only program on an\noffload-registered netdev can instead inherit a real offdev and match a\nsibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use\nbpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs\nspecialized for the bound driver on the target driver's xdp_buff. Running a\nveth-bound program on tun reads beyond tun's bare stack xdp_buff as a\nveth_xdp_buff.\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n  RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)\n  Call Trace:\n   ...\n   tun_build_skb (drivers/net/tun.c:1739)\n   tun_get_user (drivers/net/tun.c:1856)\n   tun_chr_write_iter (drivers/net/tun.c:2091)\n   vfs_write (fs/read_write.c:595 fs/read_write.c:687)\n   ksys_write (fs/read_write.c:739)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:84)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nRestrict non-offloaded programs to exact netdev matches and retain the\nshared-offdev fallback only for genuinely offloaded multi-port programs."
    }
  ],
  "lastModified": "2026-10-09T08:16:56.680",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}