CVE-2026-98381

A flaw was found in the Linux kernel's virtual Ethernet (veth) driver. When resizing network channels, the driver fails to properly clear references to detached eXpress Data Path (XDP) programs on removed receive queues. If the channel count is subsequently increased, the kernel may execute the freed program code. A local user with network administration privileges could exploit this use-after-free flaw to crash the system, resulting in a Denial of Service (DoS).

A use after free can occur because removed veth RX queues retain a stale XDP program pointer after channel reduction. If the XDP program is then detached or replaced, bpf_prog_put can release the program while the disabled queues still reference it. A later channel increase can reenable NAPI, and packet processing can execute through the freed program pointer in veth_xdp_rcv_skb, causing a kernel panic and potentially enabling more serious memory corruption. For the CVSS the PR:L reflects that a local user or container process with delegated CAP_NET_ADMIN may be able to resize veth channels and manage the XDP program without having unrestricted host root privileges. The issue is not independently network reachable because packet traffic only activates the stale pointer after the vulnerable state has been prepared locally. Impact is at least a local denial of service via kernel crash and in the worst case may include confidentiality and integrity compromise because the UAF affects a program object used in kernel control flow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.