CVE-2026-98381

veth: manage XDP program pointers during channel resize

State: Published
Severity: 7.8 High
Published: Oct 9, 2026
Updated: Oct 24, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

veth: manage XDP program pointers during channel resize

veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or replaced, those queues keep the old pointer after bpf_prog_put(). A later channel increase can re-enable NAPI and run the freed program.

BUG: unable to handle page fault for address: ffffc90000256048 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: veth_xdp_rcv_skb (include/linux/filter.h:779 include/net/xdp.h:696 drivers/net/veth.c:820) Call Trace: veth_xdp_rcv (drivers/net/veth.c:941) veth_poll (drivers/net/veth.c:986) __napi_poll (net/core/dev.c:7787) net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007) handle_softirqs (kernel/softirq.c:645) Kernel panic - not syncing: Fatal exception in interrupt

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 7a8e143109ff2736dc79e41dcd55af7ceab7520aAffected 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758Affected 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6Affected 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9Affected 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 25bb7c36225220d30f404d7e29d2e052bc5f4b99Affected 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 43f6b647f209591b1e3f726bb16b8dcba6b95908Affected 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 7104a370714346b667712913dc16abf14bbc97edAffected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 7a8e143109ff2736dc79e41dcd55af7ceab7520aAffected
4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758Affected
4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6Affected
4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9Affected
4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 25bb7c36225220d30f404d7e29d2e052bc5f4b99Affected
4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 43f6b647f209591b1e3f726bb16b8dcba6b95908Affected
4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 to before 7104a370714346b667712913dc16abf14bbc97edAffected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.