CVE-2026-80613

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> veth: fix NAPI leak in XDP enable error path<br /> <br /> During XDP enablement in veth, if xdp_rxq_info_reg() or<br /> xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.<br /> <br /> However, the rollback loop:<br /> for (i--; i &gt;= start; i--) {<br /> <br /> decrements the loop index &amp;#39;i&amp;#39; before the first iteration. This<br /> correctly skips unregistering the rxq for the failed index &amp;#39;i&amp;#39; (as<br /> registration failed or was already cleaned up), but it also<br /> erroneously skips calling netif_napi_deli() for rq[i].xdp_napi.<br /> <br /> Since netif_napi_add() was already called for index &amp;#39;i&amp;#39;, this leaves<br /> a dangling napi_struct in the device&amp;#39;s napi_list. When the veth<br /> device is later destroyed, the freed queue memory (which contains the<br /> leaked NAPI structure) can be reused.<br /> <br /> The subsequent device teardown iterates the NAPI list and<br /> corrupts the reallocated memory, leading to UAF.<br /> <br /> Fix this by explicitly deleting the NAPI association for the failed<br /> index &amp;#39;i&amp;#39; before rolling back the successfully configured queues.