EUVD-2026-66566
GHSA-3553-97wr-446g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack requires CAP_NET_ADMIN (PR:L, AV:L); use-after-free in kernel space yields full kernel trust domain (C:H/I:H/A:H); no scope change affects external systems.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_bpf: reject dev-bound programs bound to a different device
cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1).
Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device.
AnalysisAI
Traffic Control BPF classifier (cls_bpf) in the Linux kernel fails to validate that a hardware-offloaded SCHED_CLS program's bound network device matches the target TC classifier device, allowing a local attacker with CAP_NET_ADMIN to attach a program loaded for device A to device B via skip_sw. When device A is subsequently removed, the kernel destroys the program's offload state while it remains live on device B, producing a use-after-free condition that triggers a kernel WARN or panic (guaranteed denial of service with panic_on_warn=1, with potential for privilege escalation via the memory corruption primitive). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local session with CAP_NET_ADMIN (or equivalent root privileges), which is necessary both to load a BPF SCHED_CLS program specifying prog_ifindex and to configure TC classifiers with skip_sw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with a local kernel use-after-free that provides a memory corruption primitive and, at minimum, reliable denial of service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with CAP_NET_ADMIN on a Linux host or inside a privileged container loads a SCHED_CLS BPF program with prog_ifindex targeting a virtual or physical network device (device A), then uses the tc command to attach that program as a cls_bpf classifier with skip_sw on a second network device (device B). The attacker subsequently removes device A (for example, by deleting a netdevsim virtual interface or unplugging a hotplug device), causing the kernel to destroy the program's offload state while it remains referenced by device B's TC chain, triggering a use-after-free kernel WARN or panic. … |
| Remediation | The primary fix is to upgrade to a patched kernel version: 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2 (mainline), all of which add the missing device-match validation to cls_bpf_prog_from_efd() mirroring the existing XDP guard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems currently in production, identifying their kernel versions and which systems have users or services with CAP_NET_ADMIN capabilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today