Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-46321

tun: free page on short-frame rejection in tun_xdp_one()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 5.5, and 5 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk. A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 6100e0237204890269e3f934acfc50d35fd6f319 · fixed in 0a6f46a9332ad6958992d64d3b3a81a80b2ca940; From 589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 · fixed in 0e8211fcf9426f5adddf32516ba0f400ceb9544d; From ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 · fixed in e915445942af6dcea628bf66d6241641201a0c41; From d5ad89b7d01ed4e66fd04734fc63d6e78536692a · fixed in 5b34f9e4fe2f203724a6e893d6df0316b9670057; From 049584807f1d797fc3078b68035450a9769eb5c3 · fixed in 69863ff2720a0e9871f1a5710f2a33a94217fee0; From 049584807f1d797fc3078b68035450a9769eb5c3 · fixed in 37a1c268c2c8090bf4dc552d732bd23ba36f8eb0; From 049584807f1d797fc3078b68035450a9769eb5c3 · fixed in 98c67be9eb9de72465a071949e84a3cdb8fab5a3; From 049584807f1d797fc3078b68035450a9769eb5c3 · fixed in f4feb1e20058e407cb00f45aff47f5b7e19a6bbf; From 5.10.223 · fixed in 5.10.259; From 5.15.164 · fixed in 5.15.210; From 6.1.102 · fixed in 6.1.176; From 6.6.43 · fixed in 6.6.143; From 5.4.281 · fixed in 5.5; From 6.9.12 · fixed in 6.10; From 6.10.2 · fixed in 6.11

  • Linux Linux

    6.11

  • KernelLinux

    fixed in 5.10.259; From 5.11.0 · fixed in 5.15.210; From 5.16.0 · fixed in 6.1.176; From 6.2.0 · fixed in 6.6.143; From 6.7.0 · fixed in 6.12.93; From 6.11.0 · fixed in 6.18.35; From 6.13.0 · fixed in 7.0.12

References 8

git.kernel.org