CVE-2026-98382

Executive Summary

CVE-2026-98382 is an improper access control flaw in the Linux kernel eBPF offload-matching logic (__bpf_offload_dev_match()), where dev-bound-only programs can incorrectly match unrelated network devices and inherit a real offload device pointer. A caller holding CAP_BPF and CAP_NET_ADMIN can abuse bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs specialized for one driver against another driver's xdp_buff, causing memory-corruption conditions and kernel panics. Impact is local privilege escalation and denial of service on affected kernels; exploitation requires elevated capabilities but yields kernel-context memory access.

Technical Analysis

The vulnerability resides in the eBPF device-matching helper __bpf_offload_dev_match(). The function first attempts an exact netdev comparison and, on mismatch, falls back to comparing offdev (offload device) pointers. Dev-bound-only programs normally carry NULL offdev pointers, which means two unrelated netdevs can compare equal under this fallback. Additionally, a bound-only program attached to an offload-registered netdev can inherit a real offdev and then match a sibling port that was never intended to share that program.

This breaks the isolation assumption that a program bound to one device cannot execute on the packet buffers of another device. With CAP_BPF and CAP_NET_ADMIN, a caller can invoke bpf(BPF_LINK_CREATE) and supply a different target ifindex, causing the bound program to be attached and run against the target device. Because the program was specialized for its bound driver, it invokes driver-specific metadata kfuncs against the target driver's xdp_buff. In the provided crash trace, a veth-bound program ran on a tun device: the tun path builds a bare stack xdp_buff in tun_build_skb/tun_get_user, and the veth-specialized code (veth_xdp_rx_timestamp in drivers/net/veth.c) reads fields that do not exist in that smaller structure — a general protection fault / KASAN null-ptr-deref, terminating in a kernel panic. The class of issue is a type-confusion of driver-specific packet-metadata structures enabled by an access-control flaw in device matching.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance / target identification: The attacker requires local access with CAP_BPF and CAP_NET_ADMIN (observed as the stated capability precondition). They enumerate offload-registered netdevs and their sibling ports, and identify a victim device (e.g., tun) that uses a different xdp_buff layout than the driver the program is bound to (e.g., veth).
2. Trigger: The attacker loads a dev-bound-only eBPF program associated with an offload-registered netdev, causing it to inherit a real offdev. They then call bpf(BPF_LINK_CREATE) naming a different target ifindex (the sibling/unrelated device). The flawed __bpf_offload_dev_match() fallback accepts the mismatch by comparing non-NULL offdev pointers, instead of requiring an exact netdev match.
3. Execution: On packet ingress/egress through the target device, the kernel runs the bound program against the target driver's xdp_buff. The program invokes metadata kfuncs specialized for the bound driver, which interpret the target's packet metadata structure incorrectly — the crash trace shows veth_xdp_rx_timestamp executing on a buffer built by tun_build_skb, reading beyond the tun stack xdp_buff.
4. Post-exploitation impact: The immediate demonstrated outcome is memory corruption and a fatal kernel exception (kernel panic / DoS). Because the operation occurs in kernel context and turns attacker-influenced program logic loose on a mismatched memory layout, a sufficiently crafted program could plausibly achieve out-of-bounds read/write in kernel memory, providing a path to privilege escalation beyond the initial CAP_BPF/CAP_NET_ADMIN context. Exploitation is unaided by any known public tooling.

Impact Assessment

Affected systems are Linux kernels containing the vulnerable __bpf_offload_dev_match() fallback — primarily hosts and containers where untrusted or semi-trusted workloads can obtain CAP_BPF and CAP_NET_ADMIN and where eBPF XDP/offload-capable NICs (or virtual netdevs such as veth/tun) are in use. Blast radius is the kernel itself: successful triggering yields a fatal exception and system-wide panic (availability loss), with a probable escalation path via kernel-memory corruption. No CVSS score was published (N/A); the vector above is an analyst estimate reflecting local attack, high privileges required, no user interaction, and high confidentiality/integrity/availability impact once triggered. EPSS is not yet scored by FIRST.org. CISA KEV: NO.

Detection Guidance

Sigma Rule

title: Suspicious eBPF Link Creation Targeting Mismatched Netdev
id: 6b1f2c9a-4d3e-4a91-9f0b-98382cve0001
status: experimental
description: Detects bpf(BPF_LINK_CREATE) activity associated with dev-bound program attachment to non-matching target ifindex (CVE-2026-98382).
logsource:
  product: linux
  service: auditd
detection:
  selection_syscall:
    type: 'SYSCALL'
    syscall: 'bpf'
  selection_cmd:
    comm|contains:
      - 'bpftool'
      - 'bpf'
  selection_link:
    a0: '28'  # BPF_LINK_CREATE command number
  condition: selection_syscall and selection_link
falsepositives:
  - Legitimate eBPF loaders attaching XDP programs to intended devices
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.98382

YARA Rule

rule CVE_2026_98382_BPF_DEVBOUND_MISMATCH
{
    meta:
        description = "Detects eBPF loader artifacts referencing dev-bound offload matching for CVE-2026-98382"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-98382"
    strings:
        $s1 = "BPF_LINK_CREATE" ascii
        $s2 = "bpf_link_create" ascii
        $s3 = "__bpf_offload_dev_match" ascii
        $s4 = "veth_xdp_rx_timestamp" ascii
        $s5 = "xdp_buff" ascii
    condition:
        uint32(0) == 0x464c457f and 2 of ($s*)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-98382 Suspicious eBPF Offload Link Creation Pattern"; content:"|00 00|"; flow:stateless; classtype:attempted-admin; sid:9838201; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_98382;)

Elastic Detection

process where host.os.type == "linux" and event.category == "process"
and process.name in ("bpftool", "bpf") and process.command_line like~ "*link*create*"
and process.command_line regex~ ".*(dev|ifindex).*"

Splunk SPL Query

index=linux_audit sourcetype=auditd type=SYSCALL syscall=bpf a0=28
| stats count by host comm exe uid
| where count > 0

Wazuh OSSEC Rule

<group name="linux,cve-2026-98382,">
  <rule id="983820" level="10">
    <decoded_as>auditd</decoded_as>
    <field name="audit.type">SYSCALL</field>
    <field name="audit.syscall">bpf</field>
    <field name="audit.a0">28</field>
    <description>CVE-2026-98382: bpf BPF_LINK_CREATE syscall invoked (possible dev-bound program mismatch)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Vendor fix: N/A. Workarounds: N/A in the provided data.

1. Immediate mitigations: Restrict CAP_BPF and CAP_NET_ADMIN to fully trusted workloads; drop these capabilities from containers and unprivileged processes (use user-namespace/seccomp profiles that block the bpf() syscall). Monitor and log bpf(BPF_LINK_CREATE) usage. Where offload eBPF is not required, disable XDP/offload program attachment to reduce the reachable attack surface.
2. Patch/upgrade steps: No patch version is available in the provided data. Track the upstream Linux kernel commit implementing "Restrict non-offloaded programs to exact netdev matches and retain the shared-offdev fallback only for genuinely offloaded multi-port programs," and apply the corresponding stable/longterm kernel update as soon as it ships. Re-verify after upgrade since patch confidence is currently zero.
3. Long-term hardening: Apply least-privilege capability policy for eBPF at the host and orchestrator level; enable LSM/SELinux or AppArmor confinement of eBPF loaders; enable kernel hardening (KASAN in test, panic-on-oops policy evaluated against availability needs); maintain an inventory of offload-capable netdevs and enforce exact netdev program binding in custom tooling rather than relying on helper fallback behavior.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-98382
• Linux Kernel eBPF documentation and subsystem references (kernel.org)
• Upstream Linux kernel networking (netdev) patch discussion for "bpf: Reject dev-bound-only programs on other devices"
• FIRST.org EPSS (not yet scored for this CVE)
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-98382 not listed as of this report)

No known threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data.