A flaw in the Linux kernel allowed any user to detach BPF programs from tcx or netkit devices using the BPF_PROG_DETACH mechanism when no program file descriptor was supplied. The kernel performed no capability check in this scenario, so an attacker could remove a BPF program controlling networking behavior without possessing CAP_NET_ADMIN or CAP_SYS_ADMIN, potentially altering packet handling or disrupting network services. The weakness is an improper authorization check.

The vulnerability is present in the Linux kernel shipped by all vendors before the fix commit. No specific version numbers are disclosed, so all kernels lacking the patch are considered affected.

The vulnerability is a local exploit that can be performed by any user on the system, as indicated by the lack of capability checks when detaching BPF programs without a program FD. The likely attack vector is local user privilege, inferred from the description that the check is only enforced when a program FD is present; otherwise any user can detach. The publicly available CVSS score is 7.3, and the EPSS score is < 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation to date. Nevertheless, the potential to disrupt network functions or degrade security controls makes the risk moderate.