CVE-2026-98381

In the Linux kernel, the following vulnerability has been resolved:

veth: manage XDP program pointers during channel resize

veth set channels() tears down XDP resources for removed RX queues without clearing rq->xdp prog. If the program is then detached or replaced, those queues keep the old pointer after bpf prog put(). A later channel increase can re-enable NAPI and run the freed program.

BUG: unable to handle page fault for address: ffffc90000256048 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: veth xdp rcv skb (include/linux/filter.h:779 include/net/xdp.h:696 drivers/net/veth.c:820) Call Trace: veth xdp rcv (drivers/net/veth.c:941) veth poll (drivers/net/veth.c:986) napi poll (net/core/dev.c:7787) net rx action (net/core/dev.c:7850 net/core/dev.c:8007) handle softirqs (kernel/softirq.c:645) Kernel panic - not syncing: Fatal exception in interrupt