Executive brief
The Linux kernel's XDP (eXpress Data Path) program attachment mechanism has a validation bypass that allows a user to swap a normal XDP program with a restricted device-bound or offloaded program via the BPF_LINK_UPDATE operation. This bypass bypasses security checks that normally prevent mixing incompatible XDP program modes, potentially allowing privilege escalation or unauthorized program execution on network interfaces.
Technical details
The vulnerability is a logic error in the BPF XDP subsystem where bpf_xdp_link_update() directly calls dev_xdp_install() and bypasses dev_xdp_attach(), allowing an attacker to skip validation checks. The root cause is that dev_xdp_install() was used by three code paths (ip link set xdp, BPF_LINK_CREATE, and BPF_LINK_UPDATE), but only the first two went through dev_xdp_attach() which performed critical program compatibility checks. An unprivileged user with BPF capabilities can first attach a normal XDP program, then use BPF_LINK_UPDATE to swap it with an offloaded or device-bound program, bypassing restrictions on program type, attachment mode compatibility, and device binding. The fix consolidates all program validation checks into dev_xdp_install(), which all three code paths must pass through. A Linux kernel patch is available.
Affected products
- Linux Linux kernel All versions with BPF_LINK_UPDATE support (Linux 5.11+)
Timeline
- 2026-09-17: disclosed
- 2026-08-17: patched: Fix merged upstream in kernel commit ad27ed7d2309419a129078d781504f486b1b469a