CVE-2026-98381: veth: manage XDP program pointers during channel resize
In the Linux kernel, the following vulnerability has been resolved:
veth: manage XDP program pointers during channel resize
vethsetchannels() tears down XDP resources for removed RX queues without clearing rq->xdpprog. If the program is then detached or replaced, those queues keep the old pointer after bpfprogput(). A later channel increase can re-enable NAPI and run the freed program.
BUG: unable to handle page fault for address: ffffc90000256048 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: vethxdprcvskb (include/linux/filter.h:779 include/net/xdp.h:696 drivers/net/veth.c:820) Call Trace: vethxdprcv (drivers/net/veth.c:941) vethpoll (drivers/net/veth.c:986) napipoll (net/core/dev.c:7787) netrxaction (net/core/dev.c:7850 net/core/dev.c:8007) handlesoftirqs (kernel/softirq.c:645) Kernel panic - not syncing: Fatal exception in interrupt
Affected Software
Event History
Frequently Asked Questions
What sequence is required to trigger the stale program pointer?
The veth interface must have an XDP program and undergo a channel resize that removes RX queues. The XDP program must then be detached or replaced, followed by a channel increase that re-enables NAPI on the previously removed queues.
What is the observed impact when the stale pointer is used?
A later receive-path execution can run a freed XDP program. The reported result is a page fault in veth_xdp_rcv_skb followed by a kernel panic.