Executive brief
The Linux kernel's BPF traffic classifier component contains a flaw that can cause a stack overflow when handling failed hardware offload operations. When a network driver's offload callback fails repeatedly, the cls_bpf code enters infinite recursion attempting to roll back the operation, exhausting kernel stack memory and crashing the system. This affects systems that use BPF-based traffic control with hardware offloading.
Technical details
The vulnerability is an unbounded recursion flaw in cls_bpf_offload_cmd() in the Linux kernel's traffic control subsystem (net/sched/cls_bpf.c). When tc_setup_cb_replace() fails during hardware offload of a BPF classifier, the code attempts to roll back by recursively calling cls_bpf_offload_cmd() with swapped program arguments. If the rollback also fails (e.g., due to driver issues or the bpf_tc_accept debugfs knob being disabled), the same failure condition recurs, triggering another rollback attempt with identical arguments—creating infinite recursion until stack exhaustion. The fix adds an is_rollback flag parameter to prevent second-level recursion; once in a rollback state, if the operation fails again, the function returns the error instead of recursing further. The vulnerability requires network root privileges to exploit via tc filter operations and affects any kernel version with BPF hardware offload support.
Affected products
- Linux Linux kernel affected versions before patch commit 27db54b90bcc7c37867fe664107fa25ea6a116e4
Timeline
- 2026-08-15: disclosed
- 2026-05-26: patched