CVE-2026-80613

CVE-2026-80613 is a flaw in the Linux kernel's veth virtual network driver: when enabling XDP on a veth device fails at the receive-queue registration step, the error-path rollback skips deleting the NAPI polling structure for the failed queue, leaving a dangling napi_struct on the device's NAPI list. The bug is triggered when a veth device that hit this XDP-registration failure is later destroyed: the freed queue memory can be reused, and teardown then walks the stale NAPI entry and corrupts the reallocated memory, causing a use-after-free. An attacker able to create and destroy veth devices with XDP enabled — typically a local user or container workload with network administration rights — gains kernel memory corruption that can crash the host and potentially achieve local privilege escalation, consistent with the high local CVSS score. All kernels containing the vulnerable veth code are technically affected, but only configurations that actually enable XDP on veth (e.g., some container networking setups and XDP testing) can reach the faulty path. No public proof-of-concept or in-the-wild exploitation is known; EPSS estimates a roughly 0.1% probability of exploitation in the next 30 days and the flaw is not in CISA KEV.

What to do: Update the Linux kernel to a release or vendor build that includes the upstream fix commit 'veth: fix NAPI leak in XDP enable error path' and verify the fix appears in your distribution's changelog. Until patched, avoid enabling XDP on veth devices or reconfiguring/destroying veth devices with XDP enabled, and audit whether your workloads or CNI plugins use XDP over veth.