« Volver al listado

CVE-2026-98381

Estado: RecibidaSin puntuar—

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:

veth: gestionar punteros de programas XDP durante el cambio de tamaño de canales

veth_set_channels() destruye recursos XDP para colas RX eliminadas sin limpiar rq->xdp_prog. Si el programa se desasocia o reemplaza posteriormente, esas colas mantienen el puntero antiguo después de bpf_prog_put(). Un aumento posterior de canales puede reactivar NAPI y ejecutar el programa liberado.

Detalles técnicos trazas, registros y código del informe original
  BUG: unable to handle page fault for address: ffffc90000256048
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
                         include/net/xdp.h:696 drivers/net/veth.c:820)
  Call Trace:
   veth_xdp_rcv (drivers/net/veth.c:941)
   veth_poll (drivers/net/veth.c:986)
   __napi_poll (net/core/dev.c:7787)
   net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
   handle_softirqs (kernel/softirq.c:645)
  Kernel panic - not syncing: Fatal exception in interrupt

Traducción automática del texto original de NVD (en inglés).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98381",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "7a8e143109ff2736dc79e41dcd55af7ceab7520a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "1a5c5b9c64ba5f39dba55da6e12561ca56eeb758",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "25bb7c36225220d30f404d7e29d2e052bc5f4b99",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "43f6b647f209591b1e3f726bb16b8dcba6b95908",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "7104a370714346b667712913dc16abf14bbc97ed",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/veth.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc5",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/veth.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-09T08:16:56.547",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers during channel resize\n\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq->xdp_prog.  If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\n\n  BUG: unable to handle page fault for address: ffffc90000256048\n  Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n  RIP: veth_xdp_rcv_skb (include/linux/filter.h:779\n                         include/net/xdp.h:696 drivers/net/veth.c:820)\n  Call Trace:\n   veth_xdp_rcv (drivers/net/veth.c:941)\n   veth_poll (drivers/net/veth.c:986)\n   __napi_poll (net/core/dev.c:7787)\n   net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\n   handle_softirqs (kernel/softirq.c:645)\n  Kernel panic - not syncing: Fatal exception in interrupt"
    }
  ],
  "lastModified": "2026-10-09T08:16:56.547",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}