CVE-2026-80613

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80613", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.773Z", "datePublished": "2026-08-28T06:48:35.127Z", "dateUpdated": "2026-10-16T19:26:30.677Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:21:21.618Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix NAPI leak in XDP enable error path\n\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\n\nHowever, the rollback loop:\n\tfor (i--; i >= start; i--) {\n\ndecrements the loop index 'i' before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index 'i' (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\n\nSince netif_napi_add() was already called for index 'i', this leaves\na dangling napi_struct in the device's napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\n\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\n\nFix this by explicitly deleting the NAPI association for the failed\nindex 'i' before rolling back the successfully configured queues."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through local veth/XDP setup syscalls (RTM_NEWLINK/RTM_SETLINK IFLA_XDP and bpf prog load/attach) that call veth_enable_xdp_range(); remote packets and network-facing services never execute this driver registration error-rollback path.\nAC:L - An attacker in a user+network namespace controls the full create/attach/delete sequence and can repeatedly drive the XDP enable error path then RTM_DELLINK teardown; once the NAPI leak occurs, netdev_napi_exit() deterministically dereferences the freed veth_rq-embedded napi_struct.\nPR:L - Triggering requires CAP_NET_ADMIN for veth lifecycle/XDP attach and CAP_BPF to load XDP programs; both are ns_capable() in the netns user_ns and obtainable by an unprivileged local user via unshare -Urn, not init-namespace root.\nUI:N - No victim interaction is required; the attacker performs all rtnetlink and BPF syscalls to create the veth pair, attempt XDP enablement, and delete the interface that triggers the latent UAF during netdev teardown.\nS:U - Impact is kernel heap corruption and privilege escalation within the same host security authority; it does not cross a VM, container runtime, or IOMMU boundary to affect a separate security domain.\nC:H - Leaked NAPI entries leave dangling pointers into freed veth_rq slabs; netdev_napi_exit() iterates napi_list and performs list_del_rcu/gro_cleanup on reallocated memory, a classic UAF enabling arbitrary kernel memory disclosure.\nI:H - The teardown UAF writes through stale napi_struct fields into attacker-influenced heap objects, providing memory corruption primitives that can be developed into arbitrary kernel write and code execution.\nA:H - UAF during free_netdev()/netdev_napi_exit() causes kernel oops/panic on veth deletion; on multi-tenant hosts allowing user namespaces this yields repeatable host-wide denial of service from a container tenant."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/veth.c"], "versions": [{"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "fc51373345e7e6ea73da2650cb497309c50b077a", "status": "affected", "versionType": "git"}, {"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "4559770b2a241344d762719e674241fcc8528f02", "status": "affected", "versionType": "git"}, {"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "83090f5e7b54721d71875a6c224d2490b9e73050", "status": "affected", "versionType": "git"}, {"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "d3eb258ad398cc9402bab3a5e730cd7c5b34efad", "status": "affected", "versionType": "git"}, {"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "a9e6707322ef215d39d4655b176c094f45f0ab52", "status": "affected", "versionType": "git"}, {"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "4bd2e5dbe62334aae1182d0f0d260f334a49d739", "status": "affected", "versionType": "git"}, {"version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "6739027cb72da26890edd424c77080d187b2a92e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/veth.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a"}, {"url": "https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02"}, {"url": "https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050"}, {"url": "https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad"}, {"url": "https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52"}, {"url": "https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739"}, {"url": "https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e"}], "title": "veth: fix NAPI leak in XDP enable error path", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80613", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:18:46.870798Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:30.677Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80613", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:18:46.870798Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:18:48.180Z"}}], "cna": {"title": "veth: fix NAPI leak in XDP enable error path", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through local veth/XDP setup syscalls (RTM_NEWLINK/RTM_SETLINK IFLA_XDP and bpf prog load/attach) that call veth_enable_xdp_range(); remote packets and network-facing services never execute this driver registration error-rollback path.\nAC:L - An attacker in a user+network namespace controls the full create/attach/delete sequence and can repeatedly drive the XDP enable error path then RTM_DELLINK teardown; once the NAPI leak occurs, netdev_napi_exit() deterministically dereferences the freed veth_rq-embedded napi_struct.\nPR:L - Triggering requires CAP_NET_ADMIN for veth lifecycle/XDP attach and CAP_BPF to load XDP programs; both are ns_capable() in the netns user_ns and obtainable by an unprivileged local user via unshare -Urn, not init-namespace root.\nUI:N - No victim interaction is required; the attacker performs all rtnetlink and BPF syscalls to create the veth pair, attempt XDP enablement, and delete the interface that triggers the latent UAF during netdev teardown.\nS:U - Impact is kernel heap corruption and privilege escalation within the same host security authority; it does not cross a VM, container runtime, or IOMMU boundary to affect a separate security domain.\nC:H - Leaked NAPI entries leave dangling pointers into freed veth_rq slabs; netdev_napi_exit() iterates napi_list and performs list_del_rcu/gro_cleanup on reallocated memory, a classic UAF enabling arbitrary kernel memory disclosure.\nI:H - The teardown UAF writes through stale napi_struct fields into attacker-influenced heap objects, providing memory corruption primitives that can be developed into arbitrary kernel write and code execution.\nA:H - UAF during free_netdev()/netdev_napi_exit() causes kernel oops/panic on veth deletion; on multi-tenant hosts allowing user namespaces this yields repeatable host-wide denial of service from a container tenant."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "fc51373345e7e6ea73da2650cb497309c50b077a", "versionType": "git"}, {"status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "4559770b2a241344d762719e674241fcc8528f02", "versionType": "git"}, {"status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "83090f5e7b54721d71875a6c224d2490b9e73050", "versionType": "git"}, {"status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "d3eb258ad398cc9402bab3a5e730cd7c5b34efad", "versionType": "git"}, {"status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "a9e6707322ef215d39d4655b176c094f45f0ab52", "versionType": "git"}, {"status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "4bd2e5dbe62334aae1182d0f0d260f334a49d739", "versionType": "git"}, {"status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "lessThan": "6739027cb72da26890edd424c77080d187b2a92e", "versionType": "git"}], "programFiles": ["drivers/net/veth.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/veth.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a"}, {"url": "https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02"}, {"url": "https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050"}, {"url": "https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad"}, {"url": "https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52"}, {"url": "https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739"}, {"url": "https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix NAPI leak in XDP enable error path\n\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\n\nHowever, the rollback loop:\n\tfor (i--; i >= start; i--) {\n\ndecrements the loop index 'i' before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index 'i' (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\n\nSince netif_napi_add() was already called for index 'i', this leaves\na dangling napi_struct in the device's napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\n\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\n\nFix this by explicitly deleting the NAPI association for the failed\nindex 'i' before rolling back the successfully configured queues."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:21:21.618Z"}}}, "cveMetadata": {"cveId": "CVE-2026-80613", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:26:30.677Z", "dateReserved": "2026-08-26T14:34:25.773Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-28T06:48:35.127Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/veth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fc51373345e7e6ea73da2650cb497309c50b077a", "status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "versionType": "git"}, {"lessThan": "4559770b2a241344d762719e674241fcc8528f02", "status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "versionType": "git"}, {"lessThan": "83090f5e7b54721d71875a6c224d2490b9e73050", "status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "versionType": "git"}, {"lessThan": "d3eb258ad398cc9402bab3a5e730cd7c5b34efad", "status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "versionType": "git"}, {"lessThan": "a9e6707322ef215d39d4655b176c094f45f0ab52", "status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "versionType": "git"}, {"lessThan": "4bd2e5dbe62334aae1182d0f0d260f334a49d739", "status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "versionType": "git"}, {"lessThan": "6739027cb72da26890edd424c77080d187b2a92e", "status": "affected", "version": "b02e5a0ebb172c8276cea3151942aac681f7a4a6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/veth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix NAPI leak in XDP enable error path\n\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\n\nHowever, the rollback loop:\n\tfor (i--; i >= start; i--) {\n\ndecrements the loop index 'i' before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index 'i' (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\n\nSince netif_napi_add() was already called for index 'i', this leaves\na dangling napi_struct in the device's napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\n\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\n\nFix this by explicitly deleting the NAPI association for the failed\nindex 'i' before rolling back the successfully configured queues."}], "id": "CVE-2026-80613", "lastModified": "2026-10-16T20:18:03.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80613", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:18:46.870798Z", "version": "2.0.3"}}]}, "published": "2026-08-28T08:16:45.303", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: veth: fix NAPI leak in XDP enable error path", "id": "2525447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525447"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nveth: fix NAPI leak in XDP enable error path\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\nHowever, the rollback loop:\nfor (i--; i >= start; i--) {\ndecrements the loop index 'i' before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index 'i' (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\nSince netif_napi_add() was already called for index 'i', this leaves\na dangling napi_struct in the device's napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\nFix this by explicitly deleting the NAPI association for the failed\nindex 'i' before rolling back the successfully configured queues.", "A flaw was found in the Linux kernel's veth component. An error in the rollback mechanism during XDP (eXpress Data Path) enablement can lead to a Networked Asynchronous Packet Interface (NAPI) structure not being properly deallocated. This results in a Use-After-Free (UAF) vulnerability, where freed memory is improperly accessed, potentially leading to memory corruption when the veth device is later destroyed."], "name": "CVE-2026-80613", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80613\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80613\nhttps://lore.kernel.org/linux-cve-announce/2026082834-CVE-2026-80613-fc8e@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b02e5a0ebb172c8276cea3151942aac681f7a4a6,fc51373345e7e6ea73da2650cb497309c50b077a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b02e5a0ebb172c8276cea3151942aac681f7a4a6,4559770b2a241344d762719e674241fcc8528f02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b02e5a0ebb172c8276cea3151942aac681f7a4a6,83090f5e7b54721d71875a6c224d2490b9e73050)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b02e5a0ebb172c8276cea3151942aac681f7a4a6,d3eb258ad398cc9402bab3a5e730cd7c5b34efad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b02e5a0ebb172c8276cea3151942aac681f7a4a6,a9e6707322ef215d39d4655b176c094f45f0ab52)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b02e5a0ebb172c8277d02cea3151942aac681f7a4a6,4bd2e5dbe62334aae1182d0f0d260f334a49d739)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b02e5a0ebb172c8277d02cea3151942aac681f7a4a6,6739027cb72da26890edd424c77080d187b2a92e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T10:45:04.009954+00:00", "updated": "2026-09-02T08:00:14.118277+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}