Linux Kernel CVE-2026-98381

Exploitation requires local access to a system with a veth (virtual Ethernet) device that has an XDP program attached, plus the capability to resize that device's channels and attach/detach XDP programs - normally CAP_NET_ADMIN, obtainable by an unprivileged user only where unprivileged user namespaces are permitted. The attacker must perform a specific sequence: shrink veth channels (tearing down XDP resources for removed RX queues without clearing rq->xdp_prog), then detach or replace the XDP program (freeing it via bpf_prog_put()), then increase channels again to re-enable NAPI so the stale pointer is used. Limiting factors: no network-facing vector (AV:L), the veth interface must actually have an XDP program in use, and the operation sequence requires channel/XDP management privileges; hosts that forbid unprivileged user namespaces substantially raise the required privilege level.

Signals point to a genuine but non-emergency local privilege/stability issue rather than a mass-exploitation threat. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local, low-privilege vector with high impact on all three dimensions, consistent with a use-after-free in which NAPI can run a freed XDP/BPF program. Counterbalancing this, the EPSS probability is very low (0.16%, 5th percentile), there is no CISA KEV listing (not confirmed actively exploited), and no confirmed public exploit code - so real-world exploitation is at most targeted, not widespread. The vuln.today decision label 'this_week' aligns with treating this as a prompt-but-scheduled patch rather than an emergency. No SSVC exploitation/automatable/technical-impact decision values were supplied, so that framework cannot be independently applied here. The low-privilege rating (PR:L) is plausible but context-dependent: managing veth channels and XDP programs normally requires CAP_NET_ADMIN, which an unprivileged user can obtain only inside a user namespace - verify your namespace policy, because on hosts without unprivileged user namespaces this effectively requires higher privilege. Net: a real priority to schedule this week, especially on container/XDP hosts, but not a drop-everything emergency.

A local user with the ability to manage a veth device's channels and XDP programs (CAP_NET_ADMIN, potentially via an unprivileged user namespace in a container) shrinks the veth RX channels so XDP resources for the removed queues are torn down without clearing rq->xdp_prog, then detaches or replaces the XDP program so the old program is freed via bpf_prog_put(). Increasing the channel count again re-enables NAPI and causes the kernel to run the freed program, producing a page fault and kernel panic (as shown) or potentially controlled use-after-free. No public exploit identified at time of analysis; the available PoC/exploit status is not confirmed.