GHSA-6PJ2-MJ5G-XMXV

Vulnerability from github – Published: 2026-08-28 09:31 – Updated: 2026-08-29 09:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

veth: fix NAPI leak in XDP enable error path

During XDP enablement in veth, if xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.

However, the rollback loop: for (i--; i >= start; i--) {

decrements the loop index 'i' before the first iteration. This correctly skips unregistering the rxq for the failed index 'i' (as registration failed or was already cleaned up), but it also erroneously skips calling netif_napi_deli() for rq[i].xdp_napi.

Since netif_napi_add() was already called for index 'i', this leaves a dangling napi_struct in the device's napi_list. When the veth device is later destroyed, the freed queue memory (which contains the leaked NAPI structure) can be reused.

The subsequent device teardown iterates the NAPI list and corrupts the reallocated memory, leading to UAF.

Fix this by explicitly deleting the NAPI association for the failed index 'i' before rolling back the successfully configured queues.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-80613"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-28T08:16:45Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix NAPI leak in XDP enable error path\n\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\n\nHowever, the rollback loop:\n\tfor (i--; i \u003e= start; i--) {\n\ndecrements the loop index \u0027i\u0027 before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index \u0027i\u0027 (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\n\nSince netif_napi_add() was already called for index \u0027i\u0027, this leaves\na dangling napi_struct in the device\u0027s napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\n\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\n\nFix this by explicitly deleting the NAPI association for the failed\nindex \u0027i\u0027 before rolling back the successfully configured queues.",
  "id": "GHSA-6pj2-mj5g-xmxv",
  "modified": "2026-08-29T09:30:25Z",
  "published": "2026-08-28T09:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80613"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.