Executive brief
The Intel I225/I226 Ethernet driver (igc) in the Linux kernel has a flaw in its AF_XDP zero-copy networking feature. When a zero-copy application terminates abruptly, the interface gets stuck and cannot shut down, causing a denial of service where the network interface becomes unavailable. This impacts systems using AF_XDP for high-performance packet processing.
Technical details
The vulnerability is a deadlock in the igc driver's igc_down() function when handling AF_XDP zero-copy mode. When an XSK (AF_XDP socket) pool is torn down while NAPI polling is still active, igc_clean_rx_irq_zc() returns the full budget on every poll, preventing napi_complete_done() from clearing NAPI_STATE_SCHED. The igc_down() function calls napi_synchronize() before napi_disable(), which spins forever waiting for that bit to clear, deadlocking the interface shutdown. The fix removes the napi_synchronize() call and reorders operations to let napi_disable() set NAPI_STATE_DISABLE, which forces the stuck poll to complete. No authentication or network reachability is required—only local access to trigger AF_XDP operations.
Affected products
- Linux Linux kernel 5.16.0 and later (igc driver)
Timeline
- 2026-08-28: disclosed: CVE-2026-80715 published
- 2026-07-12: patched: Upstream patch committed (5ffab5b9589c50e4cfc0cf36ffd76c89422d4019)
- 2026-08-09: patched: Stable kernel backport committed (3b5aee6fcbf6b58112d40d19c8d31fa3f78ee668)