CVE-2026-31691

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

igb: remove napi_synchronize() in igb_down()

When an AF_XDP zero-copy application terminates abruptly (e.g., kill -9),

the XSK buffer pool is destroyed but NAPI polling continues.

igb_clean_rx_irq_zc() repeatedly returns the full budget, preventing

napi_complete_done() from clearing NAPI_STATE_SCHED.

igb_down() calls napi_synchronize() before napi_disable() for each queue

vector. napi_synchronize() spins waiting for NAPI_STATE_SCHED to clear,

which never happens. igb_down() blocks indefinitely, the TX watchdog

fires, and the TX queue remains permanently stalled.

napi_disable() already handles this correctly: it sets NAPI_STATE_DISABLE.

After a full-budget poll, __napi_poll() checks napi_disable_pending(). If

set, it forces completion and clears NAPI_STATE_SCHED, breaking the loop

that napi_synchronize() cannot.

napi_synchronize() was added in commit 41f149a285da ("igb: Fix possible

panic caused by Rx traffic arriv

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References