High 7.8Published Oct 9, 2026

CVE-2026-98381veth: manage XDP program pointers during channel resize

Updated under an hour ago (Oct 26, 2026, 3:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or replaced, those queues keep the old pointer after bpf_prog_put(). A later channel increase can re-enable NAPI and run the freed program. BUG: unable to handle page fault for address: ffffc90000256048 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: veth_xdp_rcv_skb (include/linux/filter.h:779 include/net/xdp.h:696 drivers/net/veth.c:820) Call Trace: veth_xdp_rcv (drivers/net/veth.c:941) veth_poll (drivers/net/veth.c:986) __napi_poll (net/core/dev.c:7787) net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007) handle_softirqs (kernel/softirq.c:645) Kernel panic - not syncing: Fatal exception in interrupt

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 7a8e143109ff2736dc79e41dcd55af7ceab7520a; 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 1a5c5b9c64ba5f39dba55da6e12561ca56eeb758; from 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6; 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9; 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 25bb7c36225220d30f404d7e29d2e052bc5f4b99; 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 builds before 43f6b647f209591b1e3f726bb16b8dcba6b95908; from 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 before 7104a370714346b667712913dc16abf14bbc97ed	CNA record

References

References

https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a
https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758
https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6
https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9
https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99
https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908
https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.