PT-2026-35497 · Linux · Linux Kernel

Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-31691

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock occurs in the igb driver when an AF XDP zero-copy application terminates abruptly. In this scenario, the XSK buffer pool is destroyed while NAPI polling continues, causing igb clean rx irq zc() to repeatedly return the full budget. This prevents napi complete done() from clearing the NAPI STATE SCHED state. Consequently, the napi synchronize() function called within igb down() spins indefinitely waiting for NAPI STATE SCHED to clear, which blocks igb down() and causes the TX watchdog to fire, leaving the TX queue permanently stalled.

Recommendations Remove the napi synchronize() call in igb down() and reorder napi disable() to occur before igb set queue napi() to ensure the queue-to-NAPI mapping is cleared only after polling has fully stopped.

Fix

Related Identifiers

CVE-2026-31691

Affected Products

Linux Kernel

References · 12

• https://git.kernel.org/stable/c/27f5997686ee7fb7ac01be72b2010f168a3409fc · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31691 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31691 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31691 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31691 · Security Note
• https://ubuntu.com/security/CVE-2026-31691 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31691 · Vendor Advisory
• https://git.kernel.org/stable/c/b1e067240379f950a0022208e0685f3465c211cb · Patch
• https://git.kernel.org/stable/c/4700471775746058c962ded6e659bf908fd76e13 · Patch
• https://twitter.com/CVEnew/status/2048852118828613671 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048968121021550886 · Twitter Post
• https://git.kernel.org/linus/b1e067240379f950a0022208e0685f3465c211cb · Note