CVE-2026-80613 (GCVE-0-2026-80613)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-08-29 06:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
veth: fix NAPI leak in XDP enable error path
During XDP enablement in veth, if xdp_rxq_info_reg() or
xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.
However, the rollback loop:
for (i--; i >= start; i--) {
decrements the loop index 'i' before the first iteration. This
correctly skips unregistering the rxq for the failed index 'i' (as
registration failed or was already cleaned up), but it also
erroneously skips calling netif_napi_deli() for rq[i].xdp_napi.
Since netif_napi_add() was already called for index 'i', this leaves
a dangling napi_struct in the device's napi_list. When the veth
device is later destroyed, the freed queue memory (which contains the
leaked NAPI structure) can be reused.
The subsequent device teardown iterates the NAPI list and
corrupts the reallocated memory, leading to UAF.
Fix this by explicitly deleting the NAPI association for the failed
index 'i' before rolling back the successfully configured queues.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b02e5a0ebb172c8276cea3151942aac681f7a4a6 Version: b02e5a0ebb172c8276cea3151942aac681f7a4a6 Version: b02e5a0ebb172c8276cea3151942aac681f7a4a6 Version: b02e5a0ebb172c8276cea3151942aac681f7a4a6 Version: b02e5a0ebb172c8276cea3151942aac681f7a4a6 Version: b02e5a0ebb172c8276cea3151942aac681f7a4a6 Version: b02e5a0ebb172c8276cea3151942aac681f7a4a6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fc51373345e7e6ea73da2650cb497309c50b077a",
"status": "affected",
"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6",
"versionType": "git"
},
{
"lessThan": "4559770b2a241344d762719e674241fcc8528f02",
"status": "affected",
"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6",
"versionType": "git"
},
{
"lessThan": "83090f5e7b54721d71875a6c224d2490b9e73050",
"status": "affected",
"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6",
"versionType": "git"
},
{
"lessThan": "d3eb258ad398cc9402bab3a5e730cd7c5b34efad",
"status": "affected",
"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6",
"versionType": "git"
},
{
"lessThan": "a9e6707322ef215d39d4655b176c094f45f0ab52",
"status": "affected",
"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6",
"versionType": "git"
},
{
"lessThan": "4bd2e5dbe62334aae1182d0f0d260f334a49d739",
"status": "affected",
"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6",
"versionType": "git"
},
{
"lessThan": "6739027cb72da26890edd424c77080d187b2a92e",
"status": "affected",
"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix NAPI leak in XDP enable error path\n\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\n\nHowever, the rollback loop:\n\tfor (i--; i \u003e= start; i--) {\n\ndecrements the loop index \u0027i\u0027 before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index \u0027i\u0027 (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\n\nSince netif_napi_add() was already called for index \u0027i\u0027, this leaves\na dangling napi_struct in the device\u0027s napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\n\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\n\nFix this by explicitly deleting the NAPI association for the failed\nindex \u0027i\u0027 before rolling back the successfully configured queues."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local veth/XDP setup syscalls (RTM_NEWLINK/RTM_SETLINK IFLA_XDP and bpf prog load/attach) that call veth_enable_xdp_range(); remote packets and network-facing services never execute this driver registration error-rollback path.\nAC:L - An attacker in a user+network namespace controls the full create/attach/delete sequence and can repeatedly drive the XDP enable error path then RTM_DELLINK teardown; once the NAPI leak occurs, netdev_napi_exit() deterministically dereferences the freed veth_rq-embedded napi_struct.\nPR:L - Triggering requires CAP_NET_ADMIN for veth lifecycle/XDP attach and CAP_BPF to load XDP programs; both are ns_capable() in the netns user_ns and obtainable by an unprivileged local user via unshare -Urn, not init-namespace root.\nUI:N - No victim interaction is required; the attacker performs all rtnetlink and BPF syscalls to create the veth pair, attempt XDP enablement, and delete the interface that triggers the latent UAF during netdev teardown.\nS:U - Impact is kernel heap corruption and privilege escalation within the same host security authority; it does not cross a VM, container runtime, or IOMMU boundary to affect a separate security domain.\nC:H - Leaked NAPI entries leave dangling pointers into freed veth_rq slabs; netdev_napi_exit() iterates napi_list and performs list_del_rcu/gro_cleanup on reallocated memory, a classic UAF enabling arbitrary kernel memory disclosure.\nI:H - The teardown UAF writes through stale napi_struct fields into attacker-influenced heap objects, providing memory corruption primitives that can be developed into arbitrary kernel write and code execution.\nA:H - UAF during free_netdev()/netdev_napi_exit() causes kernel oops/panic on veth deletion; on multi-tenant hosts allowing user namespaces this yields repeatable host-wide denial of service from a container tenant."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:21:21.618Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a"
},
{
"url": "https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02"
},
{
"url": "https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050"
},
{
"url": "https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad"
},
{
"url": "https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52"
},
{
"url": "https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739"
},
{
"url": "https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e"
}
],
"title": "veth: fix NAPI leak in XDP enable error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80613",
"datePublished": "2026-08-28T06:48:35.127Z",
"dateReserved": "2026-08-26T14:34:25.773Z",
"dateUpdated": "2026-08-29T06:21:21.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…