All vulnerabilities
CVE-2026-98381

Linux: veth: manage XDP program pointers during channel resize

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7a8e143109ff2736dc79e41dcd55af7ceab7520aAlso 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758, 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9 and 3 moreCVE List
Published9 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7a8e143109ff2736dc79e41dcd55af7ceab7520aLinuxCVE List
  • 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758LinuxCVE List
  • 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9LinuxCVE List
  • 25bb7c36225220d30f404d7e29d2e052bc5f4b99LinuxCVE List
  • 43f6b647f209591b1e3f726bb16b8dcba6b95908LinuxCVE List
  • 7104a370714346b667712913dc16abf14bbc97edLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

veth: manage XDP program pointers during channel resize

veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or replaced, those queues keep the old pointer after bpf_prog_put(). A later channel increase can re-enable NAPI and run the freed program.

BUG: unable to handle page fault for address: ffffc90000256048 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: veth_xdp_rcv_skb (include/linux/filter.h:779 include/net/xdp.h:696 drivers/net/veth.c:820) Call Trace: veth_xdp_rcv (drivers/net/veth.c:941) veth_poll (drivers/net/veth.c:986) __napi_poll (net/core/dev.c:7787) net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007) handle_softirqs (kernel/softirq.c:645) Kernel panic - not syncing: Fatal exception in interrupt

Text from CVE List

Affected versions 16

  • Linuxaffected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before 7a8e143109ff2736dc79e41dcd55af7ceab7520aCVE List
  • Linuxaffected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758CVE List
  • Linuxaffected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6CVE List
  • Linuxaffected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9CVE List
  • Linuxaffected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before 25bb7c36225220d30f404d7e29d2e052bc5f4b99CVE List
  • Linuxaffected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before 43f6b647f209591b1e3f726bb16b8dcba6b95908CVE List
  • Linuxaffected: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before 7104a370714346b667712913dc16abf14bbc97edCVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7