CVE-2026-23359

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23359
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-of-bounds write. Add a max parameter to get_upper_ifindexes() to avoid the issue. When there are too many upper devices, return -EOVERFLOW and abort the redirect. To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Then send a packet to the device to trigger the XDP redirect path.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e Patch
https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2 Patch
https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1 Patch
https://git.kernel.org/stable/c/8a95fb9df1105b1618872c2846a6c01e3ba20b45 Patch
https://git.kernel.org/stable/c/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1 Patch
https://git.kernel.org/stable/c/ca831567908fd3f73cf97d8a6c09a5054697a182 Patch
https://git.kernel.org/stable/c/d2c31d8e03d05edc16656e5ffe187f0d1da763d7 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
History

24 Apr 2026, 19:02

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e - () https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e - Patch
References () https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2 - () https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2 - Patch
References () https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1 - () https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1 - Patch
References () https://git.kernel.org/stable/c/8a95fb9df1105b1618872c2846a6c01e3ba20b45 - () https://git.kernel.org/stable/c/8a95fb9df1105b1618872c2846a6c01e3ba20b45 - Patch
References () https://git.kernel.org/stable/c/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1 - () https://git.kernel.org/stable/c/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1 - Patch
References () https://git.kernel.org/stable/c/ca831567908fd3f73cf97d8a6c09a5054697a182 - () https://git.kernel.org/stable/c/ca831567908fd3f73cf97d8a6c09a5054697a182 - Patch
References () https://git.kernel.org/stable/c/d2c31d8e03d05edc16656e5ffe187f0d1da763d7 - () https://git.kernel.org/stable/c/d2c31d8e03d05edc16656e5ffe187f0d1da763d7 - Patch
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-787

18 Apr 2026, 09:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1 -
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: bpf: Corrección de escritura fuera de límites de la pila en devmap get_upper_ifindexes() itera sobre todos los dispositivos superiores y escribe sus índices en un array sin comprobar los límites. Además, los llamadores asumen que el número máximo de dispositivos superiores es MAX_NEST_DEV y asignan excluded_devices[1+MAX_NEST_DEV] en la pila, pero esa suposición no es correcta y el número de dispositivos superiores podría ser mayor que MAX_NEST_DEV (por ejemplo, muchas macvlans), causando una escritura fuera de límites de la pila. Añadir un parámetro max a get_upper_ifindexes() para evitar el problema. Cuando hay demasiados dispositivos superiores, devolver -EOVERFLOW y abortar la redirección. Para reproducir, crear más de MAX_NEST_DEV(8) macvlans en un dispositivo con un programa XDP adjunto usando BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Luego enviar un paquete al dispositivo para activar la ruta de redirección XDP.

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-04-24 19:02

NVD link : CVE-2026-23359

Mitre link : CVE-2026-23359

CVE.ORG link : CVE-2026-23359

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write