CVE-2024-26803 is a vulnerability in the Linux kernel's virtual Ethernet (veth) driver related to the handling of Generic Receive Offload (GRO) flags when the eXpress Data Path (XDP) feature is enabled or disabled. The veth driver automatically sets the NETIF_F_GRO flag when XDP is enabled because both features share the same NAPI (New API) machinery for packet processing. The vulnerability arises from flawed logic in the veth_disable_xdp() function, which is responsible for clearing the GRO flag. This function is called both when the network device is stopped (ndo_stop) and when XDP is disabled. To prevent clearing the GRO flag when the device is down, the code skips clearing if the interface is not up (IFF_UP flag not set). However, this logic also skips clearing the GRO flag when XDP is disabled while the device is down, leading to a state where the GRO flag remains set without corresponding NAPI instances being active. This inconsistency causes a 'stray' GRO flag. Although the data path does not rely on the GRO flag, the system will crash or hang the next time the device features are synchronized, such as when a user runs ethtool or a peer changes its configuration. During synchronization, the GRO flag is cleared, and veth attempts to disable NAPI instances that were never created, resulting in either a hang in napi_disable() if NAPI was previously initialized or a crash when stopping an uninitialized hrtimer. The patch moves GRO flag updates exclusively to the XDP enable/disable paths, decoupling them from the device open/close paths, thereby preventing the flag from becoming inconsistent with the actual NAPI state. This vulnerability affects Linux kernel versions identified by the commit hash d3256efd8e8b234a6251e4d4580bd2c3c31fdc4c and was published on April 4, 2024. No known exploits are currently reported in the wild.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with the affected veth driver implementation, especially those utilizing XDP for high-performance packet processing in containerized or virtualized environments. The impact includes potential system crashes or hangs triggered by routine network configuration changes or feature synchronizations, leading to denial of service (DoS) conditions. This can disrupt critical network functions, affecting availability and potentially causing downtime in data centers, cloud infrastructure, or enterprise networks relying on Linux-based networking stacks. Since veth interfaces are commonly used in container networking (e.g., Docker, Kubernetes), organizations leveraging container orchestration may experience service interruptions. Confidentiality and integrity impacts are minimal as the vulnerability does not directly allow code execution or privilege escalation but could indirectly affect availability. The lack of known exploits reduces immediate risk, but the complexity of the bug means that inadvertent network configuration changes could trigger instability, complicating network management and operational continuity.

European organizations should prioritize updating their Linux kernel to the patched version that addresses CVE-2024-26803 as soon as it becomes available from their Linux distribution vendors. Specifically, kernel updates that move GRO flag management exclusively to XDP enable/disable paths should be applied. In the interim, administrators should avoid disabling XDP while the veth device is down and minimize network interface state changes that could trigger feature synchronization. Monitoring tools should be enhanced to detect unusual network interface state transitions or crashes related to veth devices. Container orchestration platforms should be configured to limit disruptive network reconfigurations and ensure rolling updates to kernel versions. Additionally, organizations should audit their use of veth interfaces and XDP to assess exposure and consider isolating critical workloads from affected kernel versions. Implementing robust backup and recovery procedures will help mitigate downtime caused by potential crashes. Finally, maintaining close communication with Linux distribution security advisories and applying vendor patches promptly is essential.