Executive brief
The Linux kernel's virtual Ethernet driver (veth) has a networking queue handling bug that can cause indefinite transmission stalls in multi-queue systems when GRO (Generic Receive Offload) is enabled without an XDP program. When one transmission queue becomes congested, the polling mechanism incorrectly signals queue 0 instead of the actual congested queue, preventing traffic from resuming and effectively freezing network performance on that queue.
Technical details
The vulnerability is a logic error in the veth_poll() function where the queue index used to wake the peer transmit queue is derived from rq->xdp_rxq.queue_index, which is only initialized when XDP programs are attached. In GRO-only mode (veth_napi_enable_range()), this field remains 0 for all queues due to zero-allocation of priv->rq. In multi-queue setups, when veth_xmit() stops a peer TX queue (e.g., queue 1) due to ptr_ring exhaustion, the NAPI poller incorrectly wakes queue 0 instead, leaving the congested queue in a stopped state indefinitely. Since veth lacks an ndo_tx_timeout handler, the netdev watchdog cannot recover the queue. The fix derives the queue index from the offset of rq within priv->rq, which is reliable regardless of XDP enablement status. The vulnerable code path requires multi-queue configuration and GRO enabled without XDP, affecting Linux kernels from 4.9 onward (since commit dc82a33297fc).
Affected products
- Linux Linux kernel 4.9 and later
Timeline
- 2026-08-26: disclosed: Published on NVD
- 2026-08-10: patched: Fix merged by Jakub Kicinski (commit 60db47f02bfa2aa688938aa199117ec4f8e31d23)
- 2026-08-06: other: Patch authored by Jonas Köppeler