CVE-2026-98381 in Linux
Summary
by MITRE • 10/09/2026
In the Linux kernel, the following vulnerability has been resolved:
veth: manage XDP program pointers during channel resize
veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or replaced, those queues keep the old pointer after bpf_prog_put(). A later channel increase can re-enable NAPI and run the freed program.
BUG: unable to handle page fault for address: ffffc90000256048 Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: veth_xdp_rcv_skb (include/linux/filter.h:779 include/net/xdp.h:696 drivers/net/veth.c:820) Call Trace: veth_xdp_rcv (drivers/net/veth.c:941) veth_poll (drivers/net/veth.c:986) __napi_poll (net/core/dev.c:7787) net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007) handle_softirqs (kernel/softirq.c:645) Kernel panic - not syncing: Fatal exception in interrupt
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified as CVE-2023-XXXXX involves a use-after-free condition within the Linux kernel’s virtual Ethernet driver, specifically affecting the management of eXpress Data Path (XDP) program pointers during channel resize operations. The root cause lies in the veth_set_channels function, which is responsible for adjusting the number of receive and transmit queues associated with a network interface. When the system reduces the number of RX queues, this routine correctly tears down the XDP resources allocated to the removed queues. However, it fails to clear the rq->xdp_prog pointer within the remaining queue structures. This oversight leaves stale pointers that reference memory regions which have already been freed or are no longer valid for use by those specific queues.
The operational impact of this flaw becomes apparent when an administrator subsequently detaches or replaces the XDP program associated with the interface. During this detachment process, the kernel invokes bpf_prog_put to decrement the reference count and potentially free the underlying BPF program memory. Because the stale pointers in the remaining queue structures were not cleared during the earlier channel resize, they continue to hold references to the now-freed or invalidated XDP program code. This creates a dangerous state where the driver’s internal data structures point to memory that is no longer safely accessible by the network stack logic governing those specific queues.
The vulnerability manifests as a critical kernel panic when the system later increases the number of channels, thereby re-enabling NAPI (New API) polling for the affected queues. As the kernel attempts to process incoming packets through these queues, it invokes veth_xdp_rcv_skb, which dereferences the stale rq->xdp_prog pointer. Since this pointer references freed memory, the CPU encounters an invalid page fault while attempting to execute code from that address. The resulting error trace indicates a fatal exception in interrupt context, leading to a kernel panic and system crash. This scenario effectively allows for a denial of service condition triggered by standard network configuration changes rather than requiring malicious packet injection or external exploitation beyond administrative access to modify interface parameters.
From a technical classification perspective, this vulnerability aligns with CWE-416: Use After Free, as the code continues to use a pointer after it has been freed. It also relates to CWE-20: Improper Input Validation insofar as the driver fails to properly validate and update internal state during configuration changes involving resource reallocation. In terms of MITRE ATT&CK mapping, this flaw could be leveraged for Defense Evasion or Impact categories if an attacker with local access can trigger specific channel resize operations followed by XDP program detachment to cause a system crash, thereby disrupting service availability on the host machine.
Mitigation strategies primarily involve applying kernel updates that include patches addressing veth resource management during channel adjustments. System administrators should ensure their Linux kernels are updated to versions where the rq->xdp_prog pointer is correctly cleared in all code paths within veth_set_channels when RX queues are removed. Additionally, implementing strict monitoring of network interface configurations and XDP program attachments can help detect unusual patterns that might precede exploitation attempts. For environments running vulnerable kernel versions without immediate patching capabilities, restricting user privileges to modify network channel settings or disabling dynamic XDP attachment on critical interfaces may reduce the attack surface until a permanent fix is deployed.