CVE-2026-98381: Linux Kernel veth Use-After-Free Vulnerability

CVE-2026-98381 Overview

CVE-2026-98381 is a use-after-free vulnerability in the Linux kernel's virtual Ethernet (veth) driver. The flaw resides in veth_set_channels(), which tears down eXpress Data Path (XDP) resources for removed RX queues without clearing the rq->xdp_prog pointer. When an administrator detaches or replaces the XDP program after shrinking channels, the removed queues retain stale pointers to memory freed by bpf_prog_put(). A subsequent channel increase re-enables NAPI polling and executes the freed program, triggering a kernel page fault and panic.

Critical Impact
Local users with network configuration privileges can trigger a kernel panic or potentially execute freed BPF program memory, leading to denial of service or kernel memory corruption.

Affected Products

Linux kernel versions containing the veth driver with XDP channel resize support
Multiple stable kernel branches referenced in the upstream fix commits
Distributions shipping affected mainline and long-term support kernels

Discovery Timeline

2026-10-09 - CVE-2026-98381 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-98381

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] condition in the veth driver's channel resize path. When veth_set_channels() reduces the number of RX queues, it releases the XDP resources associated with the removed queues but leaves each receive queue's xdp_prog pointer intact.

If userspace subsequently detaches the attached XDP program through bpf() syscalls or netlink, the kernel calls bpf_prog_put() and frees the program memory. The removed queues continue holding references to that freed allocation. When the administrator later grows the channel count back, NAPI is re-enabled on those queues and veth_xdp_rcv_skb() dereferences the dangling pointer.

The reported crash manifests as a page fault at an invalid address inside veth_xdp_rcv_skb via the net_rx_action softirq path, culminating in a kernel panic.

Root Cause

The root cause is incomplete cleanup state management in veth_set_channels(). The function frees per-queue XDP infrastructure without synchronizing the rq->xdp_prog field or dropping the queue's reference to the active BPF program. This leaves stale program pointers on queues that are logically inactive but structurally retained.

Attack Vector

Exploitation requires local privileges sufficient to configure network device channels (typically CAP_NET_ADMIN) and to attach or detach XDP programs. An attacker performs the sequence: attach an XDP program to a veth device, reduce RX queue count with ethtool -L, detach the program, then increase RX queue count. The next packet processed on the re-enabled queue dereferences freed BPF program memory, causing kernel panic or potentially controlled memory corruption. The vulnerability is not remotely reachable without local kernel configuration access.

No verified public exploit code is available. See the upstream commits referenced below for the technical fix.

Detection Methods for CVE-2026-98381

Indicators of Compromise

Kernel panic logs showing BUG: unable to handle page fault originating in veth_xdp_rcv_skb or veth_poll
Unexpected system reboots on hosts running container networking stacks that use veth with XDP programs
KASAN: use-after-free reports in dmesg referencing drivers/net/veth.c

Detection Strategies

Monitor kernel ring buffer and system journals for Oops or panic events tagged to the veth driver
Audit uses of ethtool -L combined with XDP program attachment and detachment on the same interface
Inventory running kernel versions against the fixed commits published on git.kernel.org

Monitoring Recommendations

Forward dmesg and /var/log/kern.log entries to a centralized logging platform for anomaly review
Track bpf() and rtnetlink syscall activity on hosts running container runtimes and service meshes
Alert on process crashes within kworker or softirq contexts tied to networking subsystems

How to Mitigate CVE-2026-98381

Immediate Actions Required

Upgrade to a Linux kernel release incorporating the upstream fix commits listed in the kernel git references
Restrict CAP_NET_ADMIN to trusted administrators and container runtimes with validated configurations
Avoid dynamic channel resize operations on veth interfaces with attached XDP programs until patched

Patch Information

The fix is distributed across the following upstream commits, which clear rq->xdp_prog and properly manage program references during veth channel resize:

Apply distribution kernel updates once vendors publish backports for their supported branches.

Workarounds

Detach XDP programs from veth interfaces before invoking ethtool -L to change channel counts
Disable XDP on veth devices in environments where channel resize is required during runtime
Pin container network interface (CNI) plugins to configurations that do not dynamically resize veth channels