In kernel v6.7, netkit was introduced. It is essentially a TC program, but is always attached using the TCX mechanism and a new attach type. It attaches directly to "netlink" network devices instead of physical or veth devices. These netlink devices drop packets by default unless an eBPF program allows a packet.
We should add a section the the BPF_PROG_TYPE_SCHED_CLS page explaining the different semantics.
https://lwn.net/Articles/949960/