{"id":"CVE-2026-99048","kind":"vulnerability","aliases":["CVE-2026-99048"],"related":[],"title":"Linux kernel gve driver: deadlock when disabling XSK pools","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix napi_disable deadlock when attempting to disable XSK pools\n\nWhen disabling XSK pools, GVE calls the unlocked versions of\nnapi_disable and napi_enable. However, the netdev lock has already been\nacquired before ndo_bpf is called because GVE supports queue management\nops. Calling the unlocked versions of napi_disable/enable results in a\ndeadlock when attempting to disable XSK pools, as the thread attempts to\nre-acquire a lock it already holds.\n\nUpdate the NAPI calls to use the locked versions.\n\nThis issue was found in production.","summary":"The gve Google Virtual NIC driver calls unlocked NAPI disable and enable functions while the netdev lock is already held, so disabling XSK pools deadlocks the thread. The impact described is a hang or denial of service on affected systems, not code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["af-xdp","google-compute-engine","gve","infrastructure","linux-kernel"],"not_affected_if":["no-gve-driver","no-xsk-pools"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:28+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:06+00:00","updated_at":"2026-10-25T04:54:06+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:54:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel gve driver: deadlock when disabling XSK pools","impact":"low","summary":"The gve Google Virtual NIC driver calls unlocked NAPI disable and enable functions while the netdev lock is already held, so disabling XSK pools deadlocks the thread. The impact described is a hang or denial of service on affected systems, not code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","gve","google-compute-engine","af-xdp"],"confidence":0.5,"needs_auth":"unknown","worst_case":"a kernel thread deadlocks, hanging the affected network path","analyst_note":"Find the fixed kernel commit and affected stable version ranges in the kernel git log or the NVD entry for CVE-2026-99048.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-gve-driver","no-xsk-pools"],"who_is_affected":"Systems running a Linux kernel with the gve driver (Google Compute Engine virtual NICs) that use AF_XDP XSK pools and disable them while queue management ops are in use. The sources do not give affected kernel version ranges. Hosts without the gve driver or without XSK pool use are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000586,"input_tokens":3426,"output_tokens":486,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-99048':12A,15A 'acquir':114C,150C 'af':17B 'af-xdp':16B 'affect':66B 'alreadi':46B,112C,154C 'attempt':87C,138C,146C 'bpf':117C 'call':34B,97C,119C,126C,159C 'code':69B 'comput':21B 'cve':10A,13A 'deadlock':5A,52B,85C,136C 'denial':62B 'describ':57B 'disabl':7A,37B,49B,84C,89C,93C,103C,140C 'disable/enable':132C 'driver':4A,33B 'enabl':39B,106C 'engin':22B 'execut':70B 'fix':82C 'follow':76C 'found':168C 'function':40B 'googl':20B,30B 'google-compute-engin':19B 'gve':3A,23B,29B,81C,96C,121C 'hang':60B 'held':47B 'hold':155C 'howev':107C 'impact':56B 'infrastructur':24B 'issu':166C 'kernel':2A,27B,74C 'linux':1A,26B,73C 'linux-kernel':25B 'lock':44B,110C,152C,163C 'manag':124C 'napi':36B,83C,102C,105C,131C,158C 'ndo':116C 'netdev':43B,109C 'nic':32B 'op':125C 'pool':9A,51B,91C,95C,142C 'product':170C 'queue':123C 're':149C 're-acquir':148C 'resolv':80C 'result':133C 'servic':64B 'support':122C 'system':67B 'thread':54B,145C 'unlock':35B,99C,128C 'updat':156C 'use':161C 'version':100C,129C,164C 'virtual':31B 'vulner':77C 'xdp':18B 'xsk':8A,50B,90C,94C,141C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the gve driver (Google Compute Engine virtual NICs) that use AF_XDP XSK pools and disable them while queue management ops are in use. The sources do not give affected kernel version ranges. Hosts without the gve driver or without XSK pool use are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99048","severity":null,"published_at":"2026-10-23T13:17:28+00:00","modified_at":"2026-10-23T13:17:28+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}