Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31691— igb: remove napi_synchronize() in igb_down()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于igb_down函数中napi_synchronize调用导致NAPI_STATE_SCHED无法清除，可能造成TX队列永久停滞。

AI Predicted 7.8 Difficulty: Easy EPSS 0.16% · P5

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 2c6196013f84651772388a86dfd4bb033d0c0d45< 4700471775746058c962ded6e659bf908fd76e13 affected
2c6196013f84651772388a86dfd4bb033d0c0d45< 27f5997686ee7fb7ac01be72b2010f168a3409fc affected
2c6196013f84651772388a86dfd4bb033d0c0d45< b1e067240379f950a0022208e0685f3465c211cb affected
6.14 affected
< 6.14 unaffected
6.18.23≤ 6.18.* unaffected
6.19.13≤ 6.19.* unaffected
7.0≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31691

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
igb: remove napi_synchronize() in igb_down()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: igb: remove napi_synchronize() in igb_down() When an AF_XDP zero-copy application terminates abruptly (e.g., kill -9), the XSK buffer pool is destroyed but NAPI polling continues. igb_clean_rx_irq_zc() repeatedly returns the full budget, preventing napi_complete_done() from clearing NAPI_STATE_SCHED. igb_down() calls napi_synchronize() before napi_disable() for each queue vector. napi_synchronize() spins waiting for NAPI_STATE_SCHED to clear, which never happens. igb_down() blocks indefinitely, the TX watchdog fires, and the TX queue remains permanently stalled. napi_disable() already handles this correctly: it sets NAPI_STATE_DISABLE. After a full-budget poll, __napi_poll() checks napi_disable_pending(). If set, it forces completion and clears NAPI_STATE_SCHED, breaking the loop that napi_synchronize() cannot. napi_synchronize() was added in commit 41f149a285da ("igb: Fix possible panic caused by Rx traffic arrival while interface is down"). napi_disable() provides stronger guarantees: it prevents further scheduling and waits for any active poll to exit. Other Intel drivers (ixgbe, ice, i40e) use napi_disable() without a preceding napi_synchronize() in their down paths. Remove redundant napi_synchronize() call and reorder napi_disable() before igb_set_queue_napi() so the queue-to-NAPI mapping is only cleared after polling has fully stopped.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于igb_down函数中napi_synchronize调用导致NAPI_STATE_SCHED无法清除，可能造成TX队列永久停滞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 2c6196013f84651772388a86dfd4bb033d0c0d45 ~ 4700471775746058c962ded6e659bf908fd76e13 -
Linux Linux 6.14 -

II. Public POCs for CVE-2026-31691

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31691

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-31691 (3)

Same Patch Batch · Linux · 2026-04-27 · 5 CVEs total

CVE-2026-31686 mm/kasan: fix double free for kasan pXds
CVE-2026-31687 gpio: omap: do not register driver in probe()
CVE-2026-31689 EDAC/mc: Fix error path ordering in edac_mc_alloc()
CVE-2026-31690 firmware: thead: Fix buffer overflow and use standard endian macros

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31691

No comments yet

Leave a comment