SB2026032592 - Out-of-bounds write in Linux kernel bpf

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026032592

SB2026032592 - Out-of-bounds write in Linux kernel bpf

Published: March 25, 2026

Security Bulletin ID SB2026032592
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Out-of-bounds write (CVE-ID: CVE-2026-23359)

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a boundary error in the BPF devmap component when handling upper device interface indices. A local user can trigger a stack-out-of-bounds write by creating more than MAX_NEST_DEV (8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS and sending a packet to the device, leading to memory corruption.

To exploit this vulnerability, the attacker must have the ability to create macvlan devices and attach XDP programs, which requires local access and privileges to perform network configuration.


Remediation

Install update from vendor's website.

References