Skip to main content

Linux Kernel igb CVE-2026-31691

| EUVDEUVD-2026-25888 MEDIUM
2026-04-27 Linux
Information Disclosure Linux Intel
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger requiring CAP_NET_ADMIN (PR:L); AC:L because once AF_XDP zero-copy is in use, a SIGKILL reliably deadlocks igb_down(); no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.7 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 05:07 vuln.today
CVSS changed
May 06, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
Apr 27, 2026 - 19:01 EUVD
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
EUVD ID Assigned
Apr 27, 2026 - 18:00 euvd
EUVD-2026-25888
CVE Published
Apr 27, 2026 - 17:34 nvd
N/A
CVE Published
Apr 27, 2026 - 17:34 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

igb: remove napi_synchronize() in igb_down()

When an AF_XDP zero-copy application terminates abruptly (e.g., kill -9), the XSK buffer pool is destroyed but NAPI polling continues. igb_clean_rx_irq_zc() repeatedly returns the full budget, preventing napi_complete_done() from clearing NAPI_STATE_SCHED.

igb_down() calls napi_synchronize() before napi_disable() for each queue vector. napi_synchronize() spins waiting for NAPI_STATE_SCHED to clear, which never happens. igb_down() blocks indefinitely, the TX watchdog fires, and the TX queue remains permanently stalled.

napi_disable() already handles this correctly: it sets NAPI_STATE_DISABLE. After a full-budget poll, __napi_poll() checks napi_disable_pending(). If set, it forces completion and clears NAPI_STATE_SCHED, breaking the loop that napi_synchronize() cannot.

napi_synchronize() was added in commit 41f149a285da ("igb: Fix possible panic caused by Rx traffic arrival while interface is down"). napi_disable() provides stronger guarantees: it prevents further scheduling and waits for any active poll to exit. Other Intel drivers (ixgbe, ice, i40e) use napi_disable() without a preceding napi_synchronize() in their down paths.

Remove redundant napi_synchronize() call and reorder napi_disable() before igb_set_queue_napi() so the queue-to-NAPI mapping is only cleared after polling has fully stopped.

AnalysisAI

Indefinite deadlock in the Linux kernel's igb Gigabit Ethernet driver causes permanent TX queue stall when an AF_XDP zero-copy application is killed abruptly. Affected systems using Intel igb-family NICs (82575, 82576, I350) experience a hang in igb_down() because napi_synchronize() waits for NAPI_STATE_SCHED to clear - a state that igb_clean_rx_irq_zc() prevents from clearing by continuously returning the full NAPI budget after the XSK buffer pool is destroyed. The TX watchdog fires and the network interface becomes permanently unavailable until reboot. No public exploit has been identified (EPSS 0.02%, 4th percentile), and upstream patches are available in stable kernel branches 6.18.23, 6.19.13, and 7.0.

Technical ContextAI

The igb driver manages Intel 82575/82576 and I350 Gigabit Ethernet controllers (CPE: cpe:2.3:a:linux:linux). The flaw is a logical ordering error in the driver's shutdown path: igb_down() calls napi_synchronize() before napi_disable() for each queue vector. Under normal operation this is safe, but when AF_XDP zero-copy mode is active and the userspace XDP application is terminated via SIGKILL, the kernel-side XSK buffer pool is freed while the igb NAPI poll handler (igb_clean_rx_irq_zc()) continues executing. This handler repeatedly returns the full NAPI budget, which causes __napi_poll() to defer calling napi_complete_done() - so NAPI_STATE_SCHED is never cleared. napi_synchronize() busy-waits on that flag indefinitely. The fix, consistent with how ixgbe, ice, and i40e are implemented, is to call napi_disable() directly: it sets NAPI_STATE_DISABLE, which __napi_poll() detects after a full-budget cycle and uses to force completion and clear NAPI_STATE_SCHED. The patch additionally reorders napi_disable() before igb_set_queue_napi() so the queue-to-NAPI mapping is only torn down after polling has fully ceased. No formal CWE has been assigned, but the root cause is equivalent to a race condition / improper synchronization in the driver teardown sequence.

RemediationAI

Apply the upstream kernel fix available in stable branches: Linux 6.18.23 (commit b1e067240379f950a0022208e0685f3465c211cb), Linux 6.19.13 (commit 4700471775746058c962ded6e659bf908fd76e13), or Linux 7.0 (commit 27f5997686ee7fb7ac01be72b2010f168a3409fc), all available at git.kernel.org/stable. Red Hat and SUSE customers should apply kernel updates through their respective vendor channels once backported patches are released. As a compensating control pending patching, disable AF_XDP zero-copy mode on igb interfaces by switching to AF_XDP copy mode (removing the XDP_ZEROCOPY flag when binding sockets) - this eliminates the trigger condition at the cost of higher CPU overhead for packet copies. Alternatively, restrict AF_XDP socket creation by limiting CAP_NET_ADMIN to trusted processes via seccomp or capability bounding sets, preventing untrusted users from creating the triggering condition. Neither workaround is zero-cost: copy mode reduces throughput and capability restrictions may interfere with legitimate network tooling.

More in Intel

View all
CVE-2021-44228 CRITICAL POC
10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
CVE-2017-5689 CRITICAL POC
9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
CVE-2012-5958 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-0217 HIGH POC
7.2 Jun 12

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and

CVE-2012-5959 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5964 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5963 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5961 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2017-5753 MEDIUM POC
5.6 Jan 04

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

CVE-2012-5965 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5962 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
CVE-2012-5960 CRITICAL POC
10.0 Jan 31

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31691 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy