CVE-2026-80613

A flaw was found in the Linux kernel's veth component. An error in the rollback mechanism during XDP (eXpress Data Path) enablement can lead to a Networked Asynchronous Packet Interface (NAPI) structure not being properly deallocated. This results in a Use-After-Free (UAF) vulnerability, where freed memory is improperly accessed, potentially leading to memory corruption when the veth device is later destroyed.

A use after free can occur in the veth XDP enable error path because netif_napi_add can succeed for a queue but the later xdp_rxq_info registration step can fail. The rollback loop decrements the index before its first iteration and can skip netif_napi_del for the failed queue, leaving a stale napi_struct linked in the device NAPI list. When the veth device is later destroyed, the queue memory containing that NAPI object can be freed and reused, while later NAPI list traversal may access or corrupt the reallocated memory. For the CVSS the PR:L is used because reliable triggering normally requires local ability to configure veth and XDP, such as CAP_NET_ADMIN or delegated network administration inside a namespace or container. The issue is not directly network reachable and is triggered through local control plane configuration, not by packet traffic. Impact is at least local denial of service via kernel crash and in the paranoid case may allow confidentiality or integrity impact because the patch context describes a real UAF with memory corruption risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.