CVE-2026-99048 gve: fix napi_disable deadlock when attempting to disable XSK pools
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99048?
CVE-2026-99048 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gve: fix napi_disable deadlock when attempting to disable XSK pools
When disabling XSK pools, GVE calls the unlocked versions of napi_disable and napi_enable. However, the netdev lock has already been acquired before ndo_bpf is called because GVE supports queue management ops. Calling the unlocked versions of napi_disable/enable results in a deadlock when attempting to disable XSK pools, as the thread attempts to re-acquire a lock it already holds.
Update the NAPI calls to use the locked versions.
This issue was found in production.
Which versions are affected by CVE-2026-99048?
How do I fix CVE-2026-99048?
Upgrade to a fixed version.
Is CVE-2026-99048 being exploited?
There is no known exploitation of CVE-2026-99048 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-99048, DEBIAN-CVE-2026-99048, GHSA-xm5j-hpp7-cww3, UBUNTU-CVE-2026-99048.