Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-46321

tun: free page on short-frame rejection in tun_xdp_one()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk. A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 6100e0237204890269e3f934acfc50d35fd6f319 to < 0a6f46a9332ad6958992d64d3b3a81a80b2ca940affected
  • 589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 to < 0e8211fcf9426f5adddf32516ba0f400ceb9544daffected
  • ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 to < e915445942af6dcea628bf66d6241641201a0c41affected
  • d5ad89b7d01ed4e66fd04734fc63d6e78536692a to < 5b34f9e4fe2f203724a6e893d6df0316b9670057affected
  • 049584807f1d797fc3078b68035450a9769eb5c3 to < 69863ff2720a0e9871f1a5710f2a33a94217fee0affected
  • 049584807f1d797fc3078b68035450a9769eb5c3 to < 37a1c268c2c8090bf4dc552d732bd23ba36f8eb0affected
  • 049584807f1d797fc3078b68035450a9769eb5c3 to < 98c67be9eb9de72465a071949e84a3cdb8fab5a3affected
  • 049584807f1d797fc3078b68035450a9769eb5c3 to < f4feb1e20058e407cb00f45aff47f5b7e19a6bbfaffected
  • 32b0aaba5dbc85816898167d9b5d45a22eae82e9affected
  • a9d1c27e2ee3b0ea5d40c105d6e728fc114470bbaffected
  • 8418f55302fa1d2eeb73e16e345167e545c598a5affected
  • 5.10.223 to < 5.10.259affected
  • 5.15.164 to < 5.15.210affected
  • 6.1.102 to < 6.1.176affected
  • 6.6.43 to < 6.6.143affected
  • 5.4.281 to < 5.5affected
  • 6.9.12 to < 6.10affected
  • 6.10.2 to < 6.11affected

Linux Linux

Default version status: affected

  • 6.11affected
  • 0 to < 6.11unaffected
  • 5.10.259 to ≤ 5.10.*unaffected
  • 5.15.210 to ≤ 5.15.*unaffected
  • 6.1.176 to ≤ 6.1.*unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.93 to ≤ 6.12.*unaffected
  • 6.18.35 to ≤ 6.18.*unaffected
  • 7.0.12 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References