Cloudanix VulnDB

CVE-2026-80715

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Killing certain network applications on some Linux machines can freeze the network card so it never shuts down properly, requiring a reboot to recover.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The igc driver enters an infinite spin in napi_synchronize() inside igc_down() because an abruptly terminated AF_XDP zero-copy application leaves NAPI_STATE_SCHED set; igc_clean_rx_irq_zc() continues returning the full budget so napi_complete_done() never clears the bit, and napi_disable() is never reached.

Why it matters to the business

Network interface shutdown hangs indefinitely on systems using the igc driver with AF_XDP zero-copy workloads, causing operational disruption, failed maintenance, and potential denial of service for dependent services until the machine is rebooted.

How an attack unfolds

An attacker with local access terminates an AF_XDP zero-copy application while the igc interface is up; the resulting race between XSK pool teardown and ongoing NAPI polling leaves the scheduler bit set, so any subsequent igc_down() call loops forever in napi_synchronize().

How to fix it

Apply the upstream kernel patch that removes the napi_synchronize() call from igc_down(), ensures napi_disable() runs first, and reorders the call ahead of igc_set_queue_napi() to match the igb fix; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the patched kernel source contains the reordered napi_disable() before igc_set_queue_napi() and lacks the napi_synchronize() call in igc_down(); test by starting and abruptly killing an AF_XDP zc application then bringing the interface down and verifying completion within seconds.

Typical attack path

  1. Obtain local execution on a system using the igc Ethernet driver with AF_XDP zero-copy sockets
  2. Start an AF_XDP application bound to an igc interface
  3. Abruptly kill the application (SIGKILL or equivalent)
  4. Trigger interface down (ifconfig down, driver unload, or reboot sequence)
  5. Observe indefinite hang in igc_down()

How to detect it

Search kernel logs and dmesg for repeated igc_down() or napi_synchronize() entries that never complete; look for processes using AF_XDP sockets on igc interfaces that terminate without subsequent interface-down success messages.

What your security team should do

  • Prioritize patching kernel packages that include the igc driver on all production systems within the next maintenance window
  • Add monitoring for processes that use AF_XDP zero-copy on igc interfaces and alert on abrupt terminations
  • Review and test interface-down automation scripts to ensure they tolerate brief hangs during rollout

The record

In the Linux kernel, the following vulnerability has been resolved: igc: remove napi_synchronize() in igc_down() When an AF_XDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the full budget on every poll, so napi_complete_done() never clears NAPI_STATE_SCHED. igc_down() calls napi_synchronize() before napi_disable(), so it spins forever waiting for that bit and the interface never goes down. Drop the napi_synchronize() and let napi_disable() do the job -- it sets NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after polling has stopped, matching the recent igb fix b1e067240379.

Affected packages

Ecosystem Package Introduced Fixed