---
id: CVE-2026-23359
title: 'bpf: Fix stack-out-of-bounds write in devmap'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix stack-out-of-bounds write in devmap

  get_upper_ifindexes() iterates over all upper devices and writes their
  indices into an array without checking bounds.

  Als…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 <
    88df604f0d16a692867582350ce3f2fcd22243f1
  - >-
    Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 <
    5000e40acc8d0c36ab709662e32120986ac22e7e
  - >-
    Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 <
    8a95fb9df1105b1618872c2846a6c01e3ba20b45
  - >-
    Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 <
    d2c31d8e03d05edc16656e5ffe187f0d1da763d7
  - >-
    Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 <
    75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2
  - >-
    Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 <
    ca831567908fd3f73cf97d8a6c09a5054697a182
  - >-
    Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 <
    b7bf516c3ecd9a2aae2dc2635178ab87b734fef1
  - Linux 5.15
published: '2026-03-25'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T08:45:43.846Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23359'
references:
  - url: 'https://git.kernel.org/stable/c/88df604f0d16a692867582350ce3f2fcd22243f1'
  - url: 'https://git.kernel.org/stable/c/5000e40acc8d0c36ab709662e32120986ac22e7e'
  - url: 'https://git.kernel.org/stable/c/8a95fb9df1105b1618872c2846a6c01e3ba20b45'
  - url: 'https://git.kernel.org/stable/c/d2c31d8e03d05edc16656e5ffe187f0d1da763d7'
  - url: 'https://git.kernel.org/stable/c/75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2'
  - url: 'https://git.kernel.org/stable/c/ca831567908fd3f73cf97d8a6c09a5054697a182'
  - url: 'https://git.kernel.org/stable/c/b7bf516c3ecd9a2aae2dc2635178ab87b734fef1'
tags:
  - cve.org
epss: 0.00131
epssPercentile: 0.02221
ingestedAt: '2026-09-08T15:33:26.992Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stack-out-of-bounds write in devmap

get_upper_ifindexes() iterates over all upper devices and writes their
indices into an array without checking bounds.

Also the callers assume that the max number of upper devices is
MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,
but that assumption is not correct and the number of upper devices could
be larger than MAX_NEST_DEV (e.g., many macvlans), causing a
stack-out-of-bounds write.

Add a max parameter to get_upper_ifindexes() to avoid the issue.
When there are too many upper devices, return -EOVERFLOW and abort the
redirect.

To reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with
an XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.
Then send a packet to the device to trigger the XDP redirect path.

## Affected

- `Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 < 88df604f0d16a692867582350ce3f2fcd22243f1`
- `Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 < 5000e40acc8d0c36ab709662e32120986ac22e7e`
- `Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 < 8a95fb9df1105b1618872c2846a6c01e3ba20b45`
- `Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 < d2c31d8e03d05edc16656e5ffe187f0d1da763d7`
- `Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 < 75d474702b2ba8b6bcb26eb3004dbc5e95ffd5d2`
- `Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 < ca831567908fd3f73cf97d8a6c09a5054697a182`
- `Linux >= aeea1b86f9363f3feabb496534d886f082a89f21 < b7bf516c3ecd9a2aae2dc2635178ab87b734fef1`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.