Executive brief
A race condition in the Linux kernel's virtual Ethernet (veth) driver can cause network traffic to permanently stall. This component is commonly used in container environments (like Docker and Kubernetes) to handle networking between the host and isolated applications. If exploited or triggered by high traffic, this flaw can lead to a complete loss of network connectivity for affected services, resulting in a denial-of-service (DoS) condition.
Technical details
A race condition exists in the veth driver (drivers/net/veth.c) due to the racy use of the __ptr_ring_empty() API from the producer side in veth_xmit(). When the transmit queue (TXQ) is full, the producer may stop the queue but fail to re-wake it because the empty check is not reliable when a consumer is active on another CPU. This results in a 'lost wakeup' where the TXQ remains in the QUEUE_STATE_DRV_XOFF state indefinitely. The vulnerability was primarily observed on ARM64 systems under high load. The fix involves removing the conditional wake-up logic in the producer and ensuring the NAPI consumer is always responsible for re-waking the TXQ after a flush.
Affected products
- Linux Linux Kernel 6.16 to 6.17.9, 6.18 (fixed)
Timeline
- 2025-11-12: patched: Initial fix commit authored
- 2025-12-16: disclosed: CVE published