CVE-2026-90146 bpf, xdp: move offload check into dev_xdp_install()
An attacker can bypass XDP offload checks by swapping programs via BPF_LINK_UPDATE, forcing offloaded programs onto the software path.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90146?
CVE-2026-90146 is a high-severity vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf, xdp: move offload check into dev_xdp_install()
bpf_xdp_link_update() calls dev_xdp_install() directly and skips dev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can make an XDP link with a normal program and then swap in an offloaded or device-bound program with BPF_LINK_UPDATE, which puts it on the software path.
dev_xdp_install() is the one place all three paths go through: "ip link set xdp" and BPF_LINK_CREATE reach it via dev_xdp_attach(), and BPF_LINK_UPDATE calls it directly. So move the program checks (offloaded, bound to another device, device-bound in generic mode, native vs generic, DEVMAP and CPUMAP) there, and keep only the netlink-flag check (XDP_FLAGS_UPDATE_IF_NOEXIST) in dev_xdp_attach().
Which versions are affected by CVE-2026-90146?
How do I fix CVE-2026-90146?
Apply the vendor's patch.
Is CVE-2026-90146 being exploited?
There is no known exploitation of CVE-2026-90146 in the wild and no public exploit code.
Sources
Also known as AZL-101993, BELL-CVE-2026-90146, DEBIAN-CVE-2026-90146, GHSA-7c8h-xm4v-9jxx, UBUNTU-CVE-2026-90146.