CVE-2026-99048
In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napi_disable and napi_enable. However, the netdev lock has already been acquired before ndo_bpf is called because GVE supports queue management ops. Calling the unlocked versions of napi_disable/enable results in a deadlock when attempting to disable XSK pools, as the thread attempts to re-acquire a lock it already holds. Update the NAPI calls to use the locked versions. This issue was found in production.
Affected versions
Linux kernel versions
6.16
and later are affected. Fixed in
6.18.57,
7.2.11,
7.3
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-99048?
CVE-2026-99048 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.16 onward and has been patched in 6.18.57, 7.2.11 and 7.3. CVE-2026-99048 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-99048?
Yes. CVE-2026-99048 has been patched. Fixed versions include 6.18.57, 7.2.11 and 7.3. If you are running Linux kernel 6.16 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-99048 actively exploited?
No. CVE-2026-99048 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.