{"api_version":"1","generated_at":"2026-08-29T12:13:31+00:00","cve":"CVE-2026-80613","urls":{"html":"https://cve.report/CVE-2026-80613","api":"https://cve.report/api/cve/CVE-2026-80613.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-80613","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-80613"},"summary":{"title":"veth: fix NAPI leak in XDP enable error path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix NAPI leak in XDP enable error path\n\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\n\nHowever, the rollback loop:\n\tfor (i--; i >= start; i--) {\n\ndecrements the loop index 'i' before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index 'i' (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\n\nSince netif_napi_add() was already called for index 'i', this leaves\na dangling napi_struct in the device's napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\n\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\n\nFix this by explicitly deleting the NAPI association for the failed\nindex 'i' before rolling back the successfully configured queues.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-28 08:16:45","updated_at":"2026-08-29 07:16:46"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52","name":"https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e","name":"https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050","name":"https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02","name":"https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a","name":"https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad","name":"https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739","name":"https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80613","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80613","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b02e5a0ebb172c8276cea3151942aac681f7a4a6 fc51373345e7e6ea73da2650cb497309c50b077a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b02e5a0ebb172c8276cea3151942aac681f7a4a6 4559770b2a241344d762719e674241fcc8528f02 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b02e5a0ebb172c8276cea3151942aac681f7a4a6 83090f5e7b54721d71875a6c224d2490b9e73050 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b02e5a0ebb172c8276cea3151942aac681f7a4a6 d3eb258ad398cc9402bab3a5e730cd7c5b34efad git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b02e5a0ebb172c8276cea3151942aac681f7a4a6 a9e6707322ef215d39d4655b176c094f45f0ab52 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b02e5a0ebb172c8276cea3151942aac681f7a4a6 4bd2e5dbe62334aae1182d0f0d260f334a49d739 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b02e5a0ebb172c8276cea3151942aac681f7a4a6 6739027cb72da26890edd424c77080d187b2a92e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.11","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.212 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.178 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.145 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"80613","cve":"CVE-2026-80613","epss":"0.001720000","percentile":"0.067600000","score_date":"2026-08-28","updated_at":"2026-08-29 00:12:17"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/veth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fc51373345e7e6ea73da2650cb497309c50b077a","status":"affected","version":"b02e5a0ebb172c8276cea3151942aac681f7a4a6","versionType":"git"},{"lessThan":"4559770b2a241344d762719e674241fcc8528f02","status":"affected","version":"b02e5a0ebb172c8276cea3151942aac681f7a4a6","versionType":"git"},{"lessThan":"83090f5e7b54721d71875a6c224d2490b9e73050","status":"affected","version":"b02e5a0ebb172c8276cea3151942aac681f7a4a6","versionType":"git"},{"lessThan":"d3eb258ad398cc9402bab3a5e730cd7c5b34efad","status":"affected","version":"b02e5a0ebb172c8276cea3151942aac681f7a4a6","versionType":"git"},{"lessThan":"a9e6707322ef215d39d4655b176c094f45f0ab52","status":"affected","version":"b02e5a0ebb172c8276cea3151942aac681f7a4a6","versionType":"git"},{"lessThan":"4bd2e5dbe62334aae1182d0f0d260f334a49d739","status":"affected","version":"b02e5a0ebb172c8276cea3151942aac681f7a4a6","versionType":"git"},{"lessThan":"6739027cb72da26890edd424c77080d187b2a92e","status":"affected","version":"b02e5a0ebb172c8276cea3151942aac681f7a4a6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/veth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.11"},{"lessThan":"5.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.178","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.145","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix NAPI leak in XDP enable error path\n\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\n\nHowever, the rollback loop:\n\tfor (i--; i >= start; i--) {\n\ndecrements the loop index 'i' before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index 'i' (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\n\nSince netif_napi_add() was already called for index 'i', this leaves\na dangling napi_struct in the device's napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\n\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\n\nFix this by explicitly deleting the NAPI association for the failed\nindex 'i' before rolling back the successfully configured queues."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local veth/XDP setup syscalls (RTM_NEWLINK/RTM_SETLINK IFLA_XDP and bpf prog load/attach) that call veth_enable_xdp_range(); remote packets and network-facing services never execute this driver registration error-rollback path.\nAC:L - An attacker in a user+network namespace controls the full create/attach/delete sequence and can repeatedly drive the XDP enable error path then RTM_DELLINK teardown; once the NAPI leak occurs, netdev_napi_exit() deterministically dereferences the freed veth_rq-embedded napi_struct.\nPR:L - Triggering requires CAP_NET_ADMIN for veth lifecycle/XDP attach and CAP_BPF to load XDP programs; both are ns_capable() in the netns user_ns and obtainable by an unprivileged local user via unshare -Urn, not init-namespace root.\nUI:N - No victim interaction is required; the attacker performs all rtnetlink and BPF syscalls to create the veth pair, attempt XDP enablement, and delete the interface that triggers the latent UAF during netdev teardown.\nS:U - Impact is kernel heap corruption and privilege escalation within the same host security authority; it does not cross a VM, container runtime, or IOMMU boundary to affect a separate security domain.\nC:H - Leaked NAPI entries leave dangling pointers into freed veth_rq slabs; netdev_napi_exit() iterates napi_list and performs list_del_rcu/gro_cleanup on reallocated memory, a classic UAF enabling arbitrary kernel memory disclosure.\nI:H - The teardown UAF writes through stale napi_struct fields into attacker-influenced heap objects, providing memory corruption primitives that can be developed into arbitrary kernel write and code execution.\nA:H - UAF during free_netdev()/netdev_napi_exit() causes kernel oops/panic on veth deletion; on multi-tenant hosts allowing user namespaces this yields repeatable host-wide denial of service from a container tenant."}]}],"providerMetadata":{"dateUpdated":"2026-08-29T06:21:21.618Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a"},{"url":"https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02"},{"url":"https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050"},{"url":"https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad"},{"url":"https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52"},{"url":"https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739"},{"url":"https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e"}],"title":"veth: fix NAPI leak in XDP enable error path","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-80613","datePublished":"2026-08-28T06:48:35.127Z","dateReserved":"2026-08-26T14:34:25.773Z","dateUpdated":"2026-08-29T06:21:21.618Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-28 08:16:45","lastModifiedDate":"2026-08-29 07:16:46","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"80613","Ordinal":"1","Title":"veth: fix NAPI leak in XDP enable error path","CVE":"CVE-2026-80613","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"80613","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix NAPI leak in XDP enable error path\n\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\n\nHowever, the rollback loop:\n\tfor (i--; i >= start; i--) {\n\ndecrements the loop index 'i' before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index 'i' (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\n\nSince netif_napi_add() was already called for index 'i', this leaves\na dangling napi_struct in the device's napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\n\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\n\nFix this by explicitly deleting the NAPI association for the failed\nindex 'i' before rolling back the successfully configured queues.","Type":"Description","Title":"veth: fix NAPI leak in XDP enable error path"}]}}}