CVE-2026-80613: Linux Kernel NAPI Use-After-Free Vulnerability

CVE-2026-80613 Overview

CVE-2026-80613 is a use-after-free vulnerability in the Linux kernel's virtual Ethernet (veth) driver. The flaw occurs in the error-handling path when enabling eXpress Data Path (XDP) on a veth interface. A rollback loop uses an off-by-one iteration that skips a required netif_napi_del() call, leaving a dangling napi_struct in the device's NAPI list. When the device is later torn down, freed queue memory containing the leaked NAPI reference gets reused, corrupting kernel memory.

Critical Impact
A local attacker with the ability to configure veth interfaces and load XDP programs can trigger memory corruption in the Linux kernel, leading to privilege escalation or kernel compromise.

Affected Products

Linux kernel veth driver (multiple stable branches)
Distributions shipping vulnerable kernel versions prior to the fix commits listed in kernel.org stable trees
Container and virtualization hosts using veth pairs with XDP

Discovery Timeline

2026-08-28 - CVE-2026-80613 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80613

Vulnerability Analysis

The vulnerability resides in the XDP enable path of the Linux veth driver. When XDP is being enabled across the device's receive queues, the driver iterates through each queue, calling netif_napi_add() followed by xdp_rxq_info_reg() and xdp_rxq_info_reg_mem_model(). If either registration call fails at index i, the driver executes a rollback loop to undo the setup for previously configured queues.

The issue is a classic off-by-one in the rollback logic. The loop for (i--; i >= start; i--) pre-decrements i before the first iteration. That correctly avoids unregistering the receive queue at the failing index, but it also incorrectly skips the netif_napi_del() call for that same index. The NAPI structure added by netif_napi_add() for the failing queue remains linked in the device's NAPI list.

When the veth device is later destroyed, its per-queue memory is freed. The freed memory can then be reallocated for other purposes. Subsequent device teardown walks the stale NAPI list entry and writes into the reallocated memory, producing a use-after-free condition [CWE-416].

Root Cause

The root cause is an asymmetric cleanup path. netif_napi_add() was invoked before the failed registration call, but the corresponding netif_napi_del() is not executed in the failure branch. The fix explicitly deletes the NAPI association for the failing index before entering the rollback loop that handles the previously configured queues.

Attack Vector

Exploitation requires local access with capabilities sufficient to create veth interfaces and attach XDP programs, typically CAP_NET_ADMIN within a network namespace. Container escape scenarios and unprivileged user namespaces on misconfigured hosts expand the practical attack surface. An attacker forces the XDP registration to fail, then triggers device teardown to corrupt the reallocated memory region and pivot toward kernel code execution or privilege escalation.

No public proof-of-concept exploit or CISA KEV listing is currently associated with this CVE. Refer to the upstream fix commits, including Kernel Commit 4559770b and Kernel Commit fc513733, for the corrected cleanup logic.

Detection Methods for CVE-2026-80613

Indicators of Compromise

Unexpected kernel Oops, general protection fault, or KASAN: use-after-free entries in dmesg referencing veth, napi, or netif_napi_del.
Kernel panics correlated with container lifecycle events such as veth pair creation, XDP attach failures, or namespace teardown.
Repeated failures from workloads calling bpf(BPF_PROG_ATTACH) or IFLA_XDP netlink operations on veth devices.

Detection Strategies

Monitor kernel logs for XDP attach errors on veth interfaces followed shortly by device deletion events.
Enable CONFIG_KASAN on test kernels to surface the underlying use-after-free during QA validation.
Track anomalous CAP_NET_ADMIN usage inside containers and unprivileged user namespaces via audit logs.

Monitoring Recommendations

Alert on kernel crashes containing the strings veth, xdp_rxq_info_reg, or napi_list in stack traces.
Correlate container runtime events (Docker, containerd, CRI-O) with subsequent kernel warnings within a short time window.
Baseline the frequency of veth create and delete operations per host and flag statistically significant spikes.

How to Mitigate CVE-2026-80613

Immediate Actions Required

Apply the upstream Linux kernel fix from the stable branch matching your deployed kernel version.
Restrict CAP_NET_ADMIN in container workloads and disable unprivileged user namespaces where operationally feasible.
Inventory hosts that run container runtimes with XDP-enabled veth interfaces and prioritize them for patching.

Patch Information

The vulnerability is resolved in multiple stable kernel trees. Reference the following commits: 4559770b, 4bd2e5db, 6739027c, 83090f5e, a9e67073, d3eb258a, and fc513733. Consult your distribution's security advisories for backported package versions.

Workarounds

Prevent untrusted workloads from attaching XDP programs to veth devices by scoping seccomp and BPF LSM policies.
Drop CAP_NET_ADMIN, CAP_BPF, and CAP_SYS_ADMIN from container security contexts that do not require them.
Set kernel.unprivileged_bpf_disabled=1 and disable unprivileged user namespaces via kernel.unprivileged_userns_clone=0 on hosts that do not need these features.

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
sysctl -w kernel.unprivileged_userns_clone=0

# Verify current kernel version and applied patches
uname -r
grep -i veth /var/log/kern.log | tail -n 50