CVE-2026-90146

In the Linux kernel, the following vulnerability has been resolved:

bpf, xdp: move offload check into dev_xdp_install()

bpf_xdp_link_update() calls dev_xdp_install() directly and skips

dev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can

make an XDP link with a normal program and then swap in an offloaded or

device-bound program with BPF_LINK_UPDATE, which puts it on the software

path.

dev_xdp_install() is the one place all three paths go through:

"ip link set xdp" and BPF_LINK_CREATE reach it via dev_xdp_attach(), and

BPF_LINK_UPDATE calls it directly. So move the program checks (offloaded,

bound to another device, device-bound in generic mode, native vs generic,

DEVMAP and CPUMAP) there, and keep only the netlink-flag check

(XDP_FLAGS_UPDATE_IF_NOEXIST) in dev_xdp_attach().