CVE-2026-98381

Status: ReceivedUnscored—

In the Linux kernel, the following vulnerability has been resolved:

veth: manage XDP program pointers during channel resize

veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or replaced, those queues keep the old pointer after bpf_prog_put(). A later channel increase can re-enable NAPI and run the freed program.

Technical details traces, logs and code from the original report

  BUG: unable to handle page fault for address: ffffc90000256048
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
                         include/net/xdp.h:696 drivers/net/veth.c:820)
  Call Trace:
   veth_xdp_rcv (drivers/net/veth.c:941)
   veth_poll (drivers/net/veth.c:986)
   __napi_poll (net/core/dev.c:7787)
   net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
   handle_softirqs (kernel/softirq.c:645)
  Kernel panic - not syncing: Fatal exception in interrupt

CVSS

NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.16%
Percentile among all scored CVEs: 5
Score date: 10/13/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux Kernel^AI

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-98381",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "7a8e143109ff2736dc79e41dcd55af7ceab7520a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "1a5c5b9c64ba5f39dba55da6e12561ca56eeb758",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "25bb7c36225220d30f404d7e29d2e052bc5f4b99",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "43f6b647f209591b1e3f726bb16b8dcba6b95908",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
              "lessThan": "7104a370714346b667712913dc16abf14bbc97ed",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/veth.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc5",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/veth.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-09T08:16:56.547",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers during channel resize\n\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq->xdp_prog.  If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\n\n  BUG: unable to handle page fault for address: ffffc90000256048\n  Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n  RIP: veth_xdp_rcv_skb (include/linux/filter.h:779\n                         include/net/xdp.h:696 drivers/net/veth.c:820)\n  Call Trace:\n   veth_xdp_rcv (drivers/net/veth.c:941)\n   veth_poll (drivers/net/veth.c:986)\n   __napi_poll (net/core/dev.c:7787)\n   net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\n   handle_softirqs (kernel/softirq.c:645)\n  Kernel panic - not syncing: Fatal exception in interrupt"
    }
  ],
  "lastModified": "2026-10-09T08:16:56.547",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}