---
id: CVE-2026-98382
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Reject dev-bound-only programs on other devices

  __bpf_offload_dev_match() falls back to comparing offdev pointers after an
  exact netdev mismatch
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Reject dev-bound-only programs on other devices

  __bpf_offload_dev_match() falls back to comparing offdev pointers after an
  exact netdev mismatch. Bound-only progr…
severity: high
published: '2026-10-09'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T08:16:56.680'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98382'
references:
  - url: 'https://git.kernel.org/stable/c/0dceda331180617aeeb22381e8480b37f18ba08b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6db1ce73e9853f533eb7f413f14ba00f8ec6f80d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/940b626854de200e6187777d42114727daca617c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bb375f3c5990e29851894f20ebc4b9dbc6676126'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e57f04194361574493e3e6cf0b9e9c69e4ae9791'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98382.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98382'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2548396'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98382'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98382'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98382.mbox
  - url: 'https://kernelcve.org/list/?q=CVE-2026-98382'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
ingestedAt: '2026-10-09T08:29:41.351Z'
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 9
  - openshift_container_platform 4
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe:
  - CWE-125
  - CWE-476
epss: 0.00161
epssPercentile: 0.05358
scores:
  vendor: 5.5
  cna: 7.8
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject dev-bound-only programs on other devices

__bpf_offload_dev_match() falls back to comparing offdev pointers after an
exact netdev mismatch. Bound-only programs normally have NULL offdevs, so
unrelated netdevs compare equal. A bound-only program on an
offload-registered netdev can instead inherit a real offdev and match a
sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use
bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs
specialized for the bound driver on the target driver's xdp_buff. Running a
veth-bound program on tun reads beyond tun's bare stack xdp_buff as a
veth_xdp_buff.

  Oops: general protection fault, probably for non-canonical address
  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
  Call Trace:
   ...
   tun_build_skb (drivers/net/tun.c:1739)
   tun_get_user (drivers/net/tun.c:1856)
   tun_chr_write_iter (drivers/net/tun.c:2091)
   vfs_write (fs/read_write.c:595 fs/read_write.c:687)
   ksys_write (fs/read_write.c:739)
   do_syscall_64 (arch/x86/entry/syscall_64.c:84)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
  Kernel panic - not syncing: Fatal exception in interrupt

Restrict non-offloaded programs to exact netdev matches and retain the
shared-offdev fallback only for genuinely offloaded multi-port programs.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98382.json)