VulnerabilityPublished 28 Aug 2026Updated 6 Nov 2026

CVE-2026-80715: Linux kernel · igc: remove napi_synchronize() in igc_down()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f929a6fe5b7ae1e72d2c6d18cd69ab90dcf689d2 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:40 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in f929a6fe5b7ae1e72d2c6d18cd69ab90dcf689d2, ad6e0df267dc96edb7de1fa0a2fb2a70645bff86, a0f16c337691813f8d8f014c01fff5a368e08898 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ fc9df2a0b520d7d439ecf464794d53e91be74b93, < f929a6fe5b7ae1e72d2c6d18cd69ab90dcf689d2	Fixed in f929a6fe5b7ae1e72d2c6d18cd69ab90dcf689d2
LinuxLinux	Affected ≥ fc9df2a0b520d7d439ecf464794d53e91be74b93, < ad6e0df267dc96edb7de1fa0a2fb2a70645bff86	Fixed in ad6e0df267dc96edb7de1fa0a2fb2a70645bff86
LinuxLinux	Affected ≥ fc9df2a0b520d7d439ecf464794d53e91be74b93, < a0f16c337691813f8d8f014c01fff5a368e08898	Fixed in a0f16c337691813f8d8f014c01fff5a368e08898
LinuxLinux	Affected ≥ fc9df2a0b520d7d439ecf464794d53e91be74b93, < 605585a8d89aaeb0122e9016fdaa92376897a705	Fixed in 605585a8d89aaeb0122e9016fdaa92376897a705
LinuxLinux	Affected ≥ fc9df2a0b520d7d439ecf464794d53e91be74b93, < 9a2b637aef4e515c2179774888441d00e8a5ae95	Fixed in 9a2b637aef4e515c2179774888441d00e8a5ae95
LinuxLinux	Affected ≥ fc9df2a0b520d7d439ecf464794d53e91be74b93, < 5ffab5b9589c50e4cfc0cf36ffd76c89422d4019	Fixed in 5ffab5b9589c50e4cfc0cf36ffd76c89422d4019

AI-suggested

A fix is available and has been applied in the Linux kernel. Users should update to a fixed kernel version that includes the referenced commits to resolve this issue. No additional mitigation steps are required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's igc driver involves improper handling of NAPI synchronization during interface shutdown when an AF_XDP zero-copy application is abruptly terminated. The issue causes the network interface to fail to go down due to a polling loop that never clears, resulting in a hang. The fix removes a problematic napi_synchronize() call and reorders operations to ensure proper polling cessation and interface shutdown.

Impact

The vulnerability causes the network interface to hang during shutdown when an AF_XDP zero-copy application is terminated abruptly, potentially leading to resource leaks or denial of service conditions on the affected system. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

Summary

The Linux kernel igc driver had a flaw where, if an AF_XDP zero-copy application was killed abruptly, the XSK pool teardown would occur while NAPI continued polling. This caused igc_clean_rx_irq_zc() to return a full budget on every poll, preventing napi_complete_done() from clearing the NAPI_STATE_SCHED bit. Consequently, igc_down() would call napi_synchronize() before napi_disable(), causing an indefinite spin waiting for the bit to clear and preventing the interface from going down. The fix removes the napi_synchronize() call and relies on napi_disable() to set NAPI_STATE_DISABLE, which forces the stuck poll to complete. Additionally, the fix reorders calls to clear the NAPI mapping only after polling has stopped, aligning with a similar fix in the igb driver.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:40 UTC

Technical details

References

Community reviews

Related threats