CVE-2026-23359

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stack-out-of-bounds write in devmap

get_upper_ifindexes() iterates over all upper devices and writes their

indices into an array without checking bounds.

Also the callers assume that the max number of upper devices is

MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,

but that assumption is not correct and the number of upper devices could

be larger than MAX_NEST_DEV (e.g., many macvlans), causing a

stack-out-of-bounds write.

Add a max parameter to get_upper_ifindexes() to avoid the issue.

When there are too many upper devices, return -EOVERFLOW and abort the

redirect.

To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with

an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.

Then send a packet to the device to trigger the XDP redirect path.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References