CVE-2024-26803

What it actually does

The flaw leaves a stray NETIF_F_GRO flag set on a veth device after XDP is disabled while the interface is down, with no subsequent synchronization on the open path; later feature resync attempts cause the kernel to invoke napi_disable on uninitialized NAPI instances, resulting in a crash or hang.

Why it matters to the business

Local users can trigger system instability or denial of service during routine network configuration changes on virtual interfaces, leading to unplanned downtime and service disruption on affected Linux systems.

How an attack unfolds

An attacker with local privileges enables XDP on a veth device, disables XDP while the device is administratively down, then performs an action that triggers feature synchronization such as an ethtool command or peer interface reconfiguration; the resulting attempt to clear the orphaned GRO flag causes the kernel to disable nonexistent NAPIs and crash or hang.

How to fix it

Upgrade affected packages to the listed fixed versions: webkit2gtk (Debian:11,12,13) to 2.30.6-1, wpewebkit (Debian:11,12,13) to 2.30.6-1, and webkit2gtk (Ubuntu:18.04:LTS) to 2.30.6-0ubuntu0.18.04.1. Reboot or reload the veth driver after applying updates to ensure GRO and XDP state remain synchronized.

How to confirm the fix worked

After patching, confirm the running kernel contains the moved GRO flag logic, use ethtool to verify NETIF_F_GRO is not set on veth devices without active XDP/NAPI instances, and test XDP enable/disable cycles while toggling interface state.

Typical attack path

1. Obtain local access and identify veth interfaces
2. Enable XDP on the target veth device
3. Disable XDP while the device is brought down
4. Trigger feature resync via ethtool or interface configuration change
5. Cause kernel crash or hang during napi_disable or hrtimer stop

How to detect it

Search kernel logs and dmesg for crashes or hangs mentioning napi_disable, uninitialized hrtimer, or veth feature synchronization after XDP or interface state changes; correlate with ethtool invocations on veth devices.

• napi_disable
• hrtimer
• veth_disable_xdp
• NETIF_F_GRO
• stray GRO flag

What your security team should do

• Apply the listed fixed package versions with highest priority on all systems exposing veth interfaces
• Restrict unprivileged local access to ethtool and network namespace operations until patches are deployed
• Monitor kernel logs for napi_disable or hrtimer-related panics following XDP configuration changes