CVE-2026-98381

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98381", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.345Z", "datePublished": "2026-10-09T07:34:21.029Z", "dateUpdated": "2026-10-24T14:08:38.193Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:08:38.193Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers during channel resize\n\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq->xdp_prog. If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\n\n BUG: unable to handle page fault for address: ffffc90000256048\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: veth_xdp_rcv_skb (include/linux/filter.h:779\n include/net/xdp.h:696 drivers/net/veth.c:820)\n Call Trace:\n veth_xdp_rcv (drivers/net/veth.c:941)\n veth_poll (drivers/net/veth.c:986)\n __napi_poll (net/core/dev.c:7787)\n net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\n handle_softirqs (kernel/softirq.c:645)\n Kernel panic - not syncing: Fatal exception in interrupt"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - ETHTOOL_MSG_CHANNELS_SET enters ethnl_set_channels() -> veth_set_channels() -> veth_disable_range_safe()/veth_enable_range_safe() -> the patched veth_napi_del_range()/__veth_napi_enable_range(); this is local netlink configuration, and final traffic comes from the veth peer, not a remote protocol message.\nAC:L - The same attacker can resize down, replace XDP so veth_xdp_set() calls bpf_prog_put(), resize up, and transmit on the restored queue. RTNL serialization makes this a deterministic sequence rather than a race or victim-dependent condition.\nPR:L - ETHTOOL_MSG_CHANNELS_SET is GENL_UNS_ADMIN_PERM and RTM_SETLINK checks CAP_NET_ADMIN in the target network namespace; BPF_PROG_LOAD uses bpf_token_capable() to accept CAP_BPF/CAP_NET_ADMIN in a delegated token's user namespace, so init-namespace root is not required.\nUI:N - The attacker performs the XDP replacement, both channel resizes, and the peer transmission; no victim must mount, open, or otherwise act on attacker-supplied data.\nS:U - The stale rq->xdp_prog is consumed by veth_xdp_rcv_skb() inside the same host kernel that owns the veth device; it does not cross a VM, IOMMU, or separate security authority.\nC:H - The removed rq retains a freed vmalloc-backed struct bpf_prog; reclaiming it controls fields read by __bpf_prog_run(), including insnsi and bpf_func, enabling kernel code execution and arbitrary kernel reads.\nI:H - veth_xdp_rcv_skb() passes the stale program to bpf_prog_run_xdp(), and __bpf_prog_run() performs an indirect call through freed prog->bpf_func; controlled reuse can redirect kernel control flow.\nA:H - The reported restored-queue packet reaches veth_xdp_rcv_skb() through veth_poll() and faults on the freed program, producing an oops and fatal kernel panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/veth.c"], "versions": [{"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "lessThan": "7a8e143109ff2736dc79e41dcd55af7ceab7520a", "status": "affected", "versionType": "git"}, {"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "lessThan": "1a5c5b9c64ba5f39dba55da6e12561ca56eeb758", "status": "affected", "versionType": "git"}, {"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "lessThan": "f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6", "status": "affected", "versionType": "git"}, {"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "lessThan": "3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9", "status": "affected", "versionType": "git"}, {"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "lessThan": "25bb7c36225220d30f404d7e29d2e052bc5f4b99", "status": "affected", "versionType": "git"}, {"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "lessThan": "43f6b647f209591b1e3f726bb16b8dcba6b95908", "status": "affected", "versionType": "git"}, {"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "lessThan": "7104a370714346b667712913dc16abf14bbc97ed", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/veth.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a"}, {"url": "https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758"}, {"url": "https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6"}, {"url": "https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9"}, {"url": "https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99"}, {"url": "https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908"}, {"url": "https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed"}], "title": "veth: manage XDP program pointers during channel resize", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/veth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7a8e143109ff2736dc79e41dcd55af7ceab7520a", "status": "affected", "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "versionType": "git"}, {"lessThan": "1a5c5b9c64ba5f39dba55da6e12561ca56eeb758", "status": "affected", "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "versionType": "git"}, {"lessThan": "f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6", "status": "affected", "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "versionType": "git"}, {"lessThan": "3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9", "status": "affected", "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "versionType": "git"}, {"lessThan": "25bb7c36225220d30f404d7e29d2e052bc5f4b99", "status": "affected", "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "versionType": "git"}, {"lessThan": "43f6b647f209591b1e3f726bb16b8dcba6b95908", "status": "affected", "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "versionType": "git"}, {"lessThan": "7104a370714346b667712913dc16abf14bbc97ed", "status": "affected", "version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/veth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers during channel resize\n\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq->xdp_prog. If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\n\n BUG: unable to handle page fault for address: ffffc90000256048\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: veth_xdp_rcv_skb (include/linux/filter.h:779\n include/net/xdp.h:696 drivers/net/veth.c:820)\n Call Trace:\n veth_xdp_rcv (drivers/net/veth.c:941)\n veth_poll (drivers/net/veth.c:986)\n __napi_poll (net/core/dev.c:7787)\n net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\n handle_softirqs (kernel/softirq.c:645)\n Kernel panic - not syncing: Fatal exception in interrupt"}], "id": "CVE-2026-98381", "lastModified": "2026-10-24T14:16:40.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-09T08:16:56.547", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: veth: manage XDP program pointers during channel resize", "id": "2548393", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548393"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nveth: manage XDP program pointers during channel resize\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq->xdp_prog. If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\nBUG: unable to handle page fault for address: ffffc90000256048\nOops: Oops: 0000 [#1] SMP KASAN NOPTI\nRIP: veth_xdp_rcv_skb (include/linux/filter.h:779\ninclude/net/xdp.h:696 drivers/net/veth.c:820)\nCall Trace:\nveth_xdp_rcv (drivers/net/veth.c:941)\nveth_poll (drivers/net/veth.c:986)\n__napi_poll (net/core/dev.c:7787)\nnet_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\nhandle_softirqs (kernel/softirq.c:645)\nKernel panic - not syncing: Fatal exception in interrupt", "A flaw was found in the Linux kernel's virtual Ethernet (veth) driver. When resizing network channels, the driver fails to properly clear references to detached eXpress Data Path (XDP) programs on removed receive queues. If the channel count is subsequently increased, the kernel may execute the freed program code. A local user with network administration privileges could exploit this use-after-free flaw to crash the system, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98381", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98381\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98381\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98381.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4752eeb3d891c27905a8fdf4d80e899c0efd4ec7,7a8e143109ff2736dc79e41dcd55af7ceab7520a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4752eeb3d891c27905a8fdf4d80e899c0efd4ec7,1a5c5b9c64ba5f39dba55da6e12561ca56eeb758)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4752eeb3d891c27905a8fdf4d80e899c0efd4ec7,f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4752eeb3d891c27905a8fdf4d80e899c0efd4ec7,3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4752eeb3d891c27905a8fdf4d80e899c0efd4ec7,25bb7c36225220d30f404d7e29d2e052bc5f4b99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4752eeb3d891c27905a8fdf4d80e899c0efd4ec7,43f6b647f209591b1e3f726bb16b8dcba6b95908)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4752eeb3d891c27905a8fdf4d80e899c0efd4ec7,7104a370714346b667712913dc16abf14bbc97ed)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-09T09:30:03.361753+00:00", "updated": "2026-10-24T15:45:07.133828+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}