Executive brief
A security vulnerability in the Linux kernel could allow a standard user to detach critical network programs without proper authorization. These programs, known as BPF programs, are often used for security filtering and network management on tcx or netkit devices. An attacker could exploit this to disable network security controls or disrupt network connectivity on the affected system.
Technical details
A vulnerability exists in the BPF subsystem of the Linux kernel related to how BPF_PROG_DETACH is handled for tcx and netkit devices. When the 'attach_bpf_fd' is not provided in the syscall attributes, the kernel bypassed necessary capability checks (CAP_NET_ADMIN or CAP_SYS_ADMIN). This allows an unprivileged local user to detach BPF programs from these network interfaces, potentially bypassing security policies or causing a denial of service. The fix introduces a mandatory capability check via 'bpf_mprog_detach_empty' to ensure only authorized users can perform this action.
Affected products
- Linux Linux Kernel Versions including tcx/netkit BPF support prior to the fix
Timeline
- 2026-01-27: other: Initial patch authored
- 2026-02-26: patched: Patch committed to stable tree
- 2026-05-27: advisory: CVE published