CVE-2026-23359 bpf: Fix stack-out-of-bounds write in devmap
A stack-out-of-bounds write in the Linux kernel BPF devmap allows attackers with specific network configurations to cause memory corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23359?
CVE-2026-23359 is a high-severity memory corruption vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix stack-out-of-bounds write in devmap
get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds.
Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-of-bounds write.
Add a max parameter to get_upper_ifindexes() to avoid the issue. When there are too many upper devices, return -EOVERFLOW and abort the redirect.
To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS. Then send a packet to the device to trigger the XDP redirect path.
Weakness: CWE-787
Which versions are affected by CVE-2026-23359?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23359?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-23359 being exploited?
There is no known exploitation of CVE-2026-23359 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-80589, BELL-CVE-2026-23359, DEBIAN-CVE-2026-23359, GHSA-5m94-46x3-f942, ROOT-OS-DEBIAN-12-CVE-2026-23359, ROOT-OS-DEBIAN-13-CVE-2026-23359 and 3 more.