CVE-2026-98381veth: manage XDP program pointers during channel resize
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or replaced, those queues keep the old pointer after bpf_prog_put(). A later channel increase can re-enable NAPI and run the freed program. BUG: unable to handle page fault for address: ffffc90000256048 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: veth_xdp_rcv_skb (include/linux/filter.h:779 include/net/xdp.h:696 drivers/net/veth.c:820) Call Trace: veth_xdp_rcv (drivers/net/veth.c:941) veth_poll (drivers/net/veth.c:986) __napi_poll (net/core/dev.c:7787) net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007) handle_softirqs (kernel/softirq.c:645) Kernel panic - not syncing: Fatal exception in interrupt
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 7a8e143109ff2736dc79e41dcd55af7ceab7520a; 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758; from 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6; 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9; 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 25bb7c36225220d30f404d7e29d2e052bc5f4b99; 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 43f6b647f209591b1e3f726bb16b8dcba6b95908; from 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before 7104a370714346b667712913dc16abf14bbc97ed | CNA record |
References
- https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a
- https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758
- https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6
- https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9
- https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99
- https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908
- https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.