CVE-2026-98381

What it actually does

Use-after-free in the veth driver where veth_set_channels tears down XDP resources on removed RX queues without clearing rq->xdp_prog, allowing a freed BPF program to be invoked later via NAPI after bpf_prog_put when channels are resized.

Why it matters to the business

Kernel crashes and panics on systems using veth interfaces with XDP programs, causing denial of service, service disruption, and potential data loss in virtualized or container networking environments.

How an attack unfolds

An attacker with local privileges resizes veth channels to remove RX queues while an XDP program is attached, detaches or replaces the program to trigger bpf_prog_put on the dangling pointer, then increases channels again to re-enable NAPI and execute the freed program, resulting in a page fault and panic.

How to fix it

Update the Linux kernel to a version containing the veth XDP program pointer management fix during channel resize; rebuild and deploy the patched kernel across affected hosts.

How to confirm the fix worked

Verify the running kernel contains the commit resolving veth_set_channels XDP pointer clearing; reproduce channel resize operations under XDP load and confirm absence of use-after-free oops or panics.

Typical attack path

1. Obtain local access on a Linux system using veth interfaces
2. Attach an XDP program to a veth device
3. Call veth_set_channels to reduce the number of RX queues
4. Detach or replace the XDP program
5. Increase the channel count to re-enable NAPI polling
6. Trigger packet reception on the affected queue to execute the freed program

How to detect it

Search kernel logs and dmesg for oops messages referencing veth_xdp_rcv_skb, page faults at addresses in XDP filter paths, or call traces involving veth_poll and __napi_poll following channel resize operations.

• veth_xdp_rcv_skb
• BUG: unable to handle page fault for address
• Oops: 0000 [#1] SMP KASAN
• RIP: veth_xdp_rcv_skb
• veth_xdp_rcv
• veth_poll
• include/linux/filter.h:779

What your security team should do

• Prioritize kernel updates on all systems using veth with XDP within the next patch cycle
• Audit veth interface configurations and XDP usage in production environments
• Monitor kernel logs for veth-related page faults and panics
• Limit unprivileged channel resizing where feasible via capabilities or namespaces