Executive brief
The Linux kernel's veth virtual networking driver contains a memory leak in its XDP (eXpress Data Path) enablement code. When XDP setup fails, the driver incorrectly skips cleanup of a NAPI (networking API) structure, leaving dangling references. When the virtual device is later destroyed, this can lead to use-after-free memory corruption and system instability.
Technical details
The vulnerability is a resource leak in the veth driver's XDP enablement error handling path. Specifically, when xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the error rollback code decrements the loop index before the first iteration, which correctly avoids unregistering the failed index but incorrectly omits calling netif_napi_del() for the corresponding NAPI structure. This leaves a dangling NAPI structure in the device's NAPI list. When the veth device is later destroyed, the freed queue memory containing the leaked NAPI structure can be reallocated for other purposes, and subsequent teardown iterations corrupt the reallocated memory, resulting in a use-after-free condition. The fix explicitly deletes the NAPI structure for the failed index before rolling back successfully configured queues. This is a kernel-mode vulnerability affecting all systems running affected Linux versions.
Affected products
- Linux Linux kernel Multiple versions (see git stable tree branches; fix applied to 4.x, 5.x, 6.x, 7.x series)
Timeline
- 2026-08-28: disclosed: Published to NVD
- 2026-07-24: patched: Fix committed and backported to stable kernel branches
- 2026-06-22: other: Patch authored by Eric Dumazet