Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-46322

tun: free page on build_skb failure in tun_xdp_one()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 043d222f93ab8c76b56a3b315cd8692e35affb6c · fixed in 26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9; From 043d222f93ab8c76b56a3b315cd8692e35affb6c · fixed in 793385c154771603b8671dd8338927221e9d8d78; From 043d222f93ab8c76b56a3b315cd8692e35affb6c · fixed in 2638a9c1521905bb5c5d1e95c8fbc09f79148ed7; From 043d222f93ab8c76b56a3b315cd8692e35affb6c · fixed in 60d9c0d6cdde5420d6483c921b16fe5465eb5238; From 043d222f93ab8c76b56a3b315cd8692e35affb6c · fixed in d16e38fac09a47bfcf98c1ad65a1bb53f94540f5; From 043d222f93ab8c76b56a3b315cd8692e35affb6c · fixed in aa308e9dbb9acb17cacdbbce9e4504f69bac8385; From 043d222f93ab8c76b56a3b315cd8692e35affb6c · fixed in 4fefc6156a162a9f50035c12091a5e5130c82c6e; From 043d222f93ab8c76b56a3b315cd8692e35affb6c · fixed in aa8963fdce667a42fb7f0bdd2909fadcab02f9a8

  • Linux Linux

    4.20

  • KernelLinux

    From 4.20.0 · fixed in 5.10.259; From 5.11.0 · fixed in 5.15.210; From 5.16.0 · fixed in 6.1.176; From 6.2.0 · fixed in 6.6.143; From 6.7.0 · fixed in 6.12.93; From 6.13.0 · fixed in 6.18.35; From 6.19.0 · fixed in 7.0.12

References 8

git.kernel.org