CVE-2026-46321 (GCVE-0-2026-46321)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:11 – Updated: 2026-08-05 12:31
VLAI
Title
tun: free page on short-frame rejection in tun_xdp_one()
Summary
In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk. A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6100e0237204890269e3f934acfc50d35fd6f319 , < 0a6f46a9332ad6958992d64d3b3a81a80b2ca940 (git)
Affected: 589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 , < 0e8211fcf9426f5adddf32516ba0f400ceb9544d (git)
Affected: ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 , < e915445942af6dcea628bf66d6241641201a0c41 (git)
Affected: d5ad89b7d01ed4e66fd04734fc63d6e78536692a , < 5b34f9e4fe2f203724a6e893d6df0316b9670057 (git)
Affected: 049584807f1d797fc3078b68035450a9769eb5c3 , < 69863ff2720a0e9871f1a5710f2a33a94217fee0 (git)
Affected: 049584807f1d797fc3078b68035450a9769eb5c3 , < 37a1c268c2c8090bf4dc552d732bd23ba36f8eb0 (git)
Affected: 049584807f1d797fc3078b68035450a9769eb5c3 , < 98c67be9eb9de72465a071949e84a3cdb8fab5a3 (git)
Affected: 049584807f1d797fc3078b68035450a9769eb5c3 , < f4feb1e20058e407cb00f45aff47f5b7e19a6bbf (git)
Affected: 32b0aaba5dbc85816898167d9b5d45a22eae82e9 (git)
Affected: a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb (git)
Affected: 8418f55302fa1d2eeb73e16e345167e545c598a5 (git)
Affected: 5.10.223 , < 5.10.259 (semver)
Affected: 5.15.164 , < 5.15.210 (semver)
Affected: 6.1.102 , < 6.1.176 (semver)
Affected: 6.6.43 , < 6.6.143 (semver)
Affected: 5.4.281 , < 5.5 (semver)
Affected: 6.9.12 , < 6.10 (semver)
Affected: 6.10.2 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a6f46a9332ad6958992d64d3b3a81a80b2ca940",
              "status": "affected",
              "version": "6100e0237204890269e3f934acfc50d35fd6f319",
              "versionType": "git"
            },
            {
              "lessThan": "0e8211fcf9426f5adddf32516ba0f400ceb9544d",
              "status": "affected",
              "version": "589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2",
              "versionType": "git"
            },
            {
              "lessThan": "e915445942af6dcea628bf66d6241641201a0c41",
              "status": "affected",
              "version": "ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146",
              "versionType": "git"
            },
            {
              "lessThan": "5b34f9e4fe2f203724a6e893d6df0316b9670057",
              "status": "affected",
              "version": "d5ad89b7d01ed4e66fd04734fc63d6e78536692a",
              "versionType": "git"
            },
            {
              "lessThan": "69863ff2720a0e9871f1a5710f2a33a94217fee0",
              "status": "affected",
              "version": "049584807f1d797fc3078b68035450a9769eb5c3",
              "versionType": "git"
            },
            {
              "lessThan": "37a1c268c2c8090bf4dc552d732bd23ba36f8eb0",
              "status": "affected",
              "version": "049584807f1d797fc3078b68035450a9769eb5c3",
              "versionType": "git"
            },
            {
              "lessThan": "98c67be9eb9de72465a071949e84a3cdb8fab5a3",
              "status": "affected",
              "version": "049584807f1d797fc3078b68035450a9769eb5c3",
              "versionType": "git"
            },
            {
              "lessThan": "f4feb1e20058e407cb00f45aff47f5b7e19a6bbf",
              "status": "affected",
              "version": "049584807f1d797fc3078b68035450a9769eb5c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "32b0aaba5dbc85816898167d9b5d45a22eae82e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8418f55302fa1d2eeb73e16e345167e545c598a5",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.259",
              "status": "affected",
              "version": "5.10.223",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.210",
              "status": "affected",
              "version": "5.15.164",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.176",
              "status": "affected",
              "version": "6.1.102",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.143",
              "status": "affected",
              "version": "6.6.43",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.281",
              "versionType": "semver"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.12",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.10.223",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.15.164",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.1.102",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.6.43",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.281",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on short-frame rejection in tun_xdp_one()\n\ntun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without\nfreeing the page that vhost_net_build_xdp() allocated for it.\ntun_sendmsg() discards that -EINVAL and still returns total_len, so\nvhost_tx_batch() takes the success path and never frees the page; each\nshort frame in a batch leaks one page-frag chunk.\n\nA local process that can open /dev/net/tun and /dev/vhost-net can hit\nthis path: it attaches a tun/tap device as the vhost-net backend and\nfeeds TX descriptors whose length minus the virtio-net header is below\nETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a\ntight submission loop exhausts host memory and triggers an OOM panic.\nFree the page before returning -EINVAL, matching the XDP-program error\npath in the same function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached via local host interfaces (/dev/net/tun and /dev/vhost-net ioctls/sendmsg) or from a KVM guest through virtio-net TX descriptors processed by vhost-net, not via remote network packets to the host stack.\nAC:L - An attacker reliably triggers the leak by repeatedly submitting TX frames whose length minus the virtio-net header is below ETH_HLEN; no races or attacker-uncontrollable layout conditions are required.\nPR:N - A malicious KVM guest on a host using vhost-net with a tun/tap backend needs no host privileges\u2014only the ability to craft short virtio-net TX descriptors\u2014while a direct host attacker can also obtain CAP_NET_ADMIN via unprivileged user namespaces.\nUI:N - Exploitation requires no victim interaction beyond normal VM or namespace operation; the attacker drives the vhost TX path directly in a tight loop.\nS:C - In the highest-impact cloud/KVM deployment, an unprivileged guest VM crosses the hypervisor security boundary to exhaust host kernel memory and panic the host, affecting resources outside the guest\u0027s security scope.\nC:N - The bug is a page-fragment memory leak with no out-of-bounds access, use-after-free, or information disclosure; freed pages are simply never returned to the allocator.\nI:N - No kernel memory corruption or data modification occurs; the only effect is unbounded consumption of page-frags leading to denial of service.\nA:H - Sustained submission of short batched frames leaks one page-frag per frame, exhausts host memory, and can trigger an OOM kernel panic as described in the fix commit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:16.239Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a6f46a9332ad6958992d64d3b3a81a80b2ca940"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e8211fcf9426f5adddf32516ba0f400ceb9544d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e915445942af6dcea628bf66d6241641201a0c41"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b34f9e4fe2f203724a6e893d6df0316b9670057"
        },
        {
          "url": "https://git.kernel.org/stable/c/69863ff2720a0e9871f1a5710f2a33a94217fee0"
        },
        {
          "url": "https://git.kernel.org/stable/c/37a1c268c2c8090bf4dc552d732bd23ba36f8eb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/98c67be9eb9de72465a071949e84a3cdb8fab5a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf"
        }
      ],
      "title": "tun: free page on short-frame rejection in tun_xdp_one()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46321",
    "datePublished": "2026-06-09T12:11:13.872Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-08-05T12:31:16.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46321",
      "date": "2026-09-22",
      "epss": "0.00129",
      "percentile": "0.0289"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-26T01:41:11.000Z",
      "cve": "CVE-2026-46321",
      "id": "msrc_CVE-2026-46321",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tun: free page on short-frame rejection in tun_xdp_one()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46321.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/tun.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0a6f46a9332ad6958992d64d3b3a81a80b2ca940",
                    "status": "affected",
                    "version": "6100e0237204890269e3f934acfc50d35fd6f319",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0e8211fcf9426f5adddf32516ba0f400ceb9544d",
                    "status": "affected",
                    "version": "589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e915445942af6dcea628bf66d6241641201a0c41",
                    "status": "affected",
                    "version": "ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b34f9e4fe2f203724a6e893d6df0316b9670057",
                    "status": "affected",
                    "version": "d5ad89b7d01ed4e66fd04734fc63d6e78536692a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "69863ff2720a0e9871f1a5710f2a33a94217fee0",
                    "status": "affected",
                    "version": "049584807f1d797fc3078b68035450a9769eb5c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "37a1c268c2c8090bf4dc552d732bd23ba36f8eb0",
                    "status": "affected",
                    "version": "049584807f1d797fc3078b68035450a9769eb5c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "98c67be9eb9de72465a071949e84a3cdb8fab5a3",
                    "status": "affected",
                    "version": "049584807f1d797fc3078b68035450a9769eb5c3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f4feb1e20058e407cb00f45aff47f5b7e19a6bbf",
                    "status": "affected",
                    "version": "049584807f1d797fc3078b68035450a9769eb5c3",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "32b0aaba5dbc85816898167d9b5d45a22eae82e9",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8418f55302fa1d2eeb73e16e345167e545c598a5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.259",
                    "status": "affected",
                    "version": "5.10.223",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.210",
                    "status": "affected",
                    "version": "5.15.164",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.176",
                    "status": "affected",
                    "version": "6.1.102",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.143",
                    "status": "affected",
                    "version": "6.6.43",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.281",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "affected",
                    "version": "6.9.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "affected",
                    "version": "6.10.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/tun.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9247B8C6-D97A-4CCC-B960-AFD2F536EFC1",
                    "versionEndExcluding": "5.5",
                    "versionStartIncluding": "5.4.281",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F8D8E517-E90E-4A05-B563-DF7F717264E2",
                    "versionEndExcluding": "5.10.259",
                    "versionStartIncluding": "5.10.223",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4C7A70B4-6094-4392-99CE-5713E2A31596",
                    "versionEndExcluding": "5.15.210",
                    "versionStartIncluding": "5.15.164",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "650D4114-2C4E-4BF7-8AB9-4CC4104FEC16",
                    "versionEndExcluding": "6.1.176",
                    "versionStartIncluding": "6.1.102",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5AF81631-4260-4438-AE5B-61C04CA0BAA0",
                    "versionEndExcluding": "6.6.143",
                    "versionStartIncluding": "6.6.43",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1FA62583-78C1-42CE-900B-6D2B268EAED2",
                    "versionEndExcluding": "6.10",
                    "versionStartIncluding": "6.9.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DAD5D9AB-C0E6-44DF-8475-306495552E60",
                    "versionEndExcluding": "6.12.93",
                    "versionStartIncluding": "6.10.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382",
                    "versionEndExcluding": "6.18.35",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3",
                    "versionEndExcluding": "7.0.12",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on short-frame rejection in tun_xdp_one()\n\ntun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without\nfreeing the page that vhost_net_build_xdp() allocated for it.\ntun_sendmsg() discards that -EINVAL and still returns total_len, so\nvhost_tx_batch() takes the success path and never frees the page; each\nshort frame in a batch leaks one page-frag chunk.\n\nA local process that can open /dev/net/tun and /dev/vhost-net can hit\nthis path: it attaches a tun/tap device as the vhost-net backend and\nfeeds TX descriptors whose length minus the virtio-net header is below\nETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a\ntight submission loop exhausts host memory and triggers an OOM panic.\nFree the page before returning -EINVAL, matching the XDP-program error\npath in the same function."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntun: liberar p\u00e1gina en el rechazo de tramas cortas en tun_xdp_one()\n\ntun_xdp_one() devuelve -EINVAL en una trama m\u00e1s corta que ETH_HLEN sin liberar la p\u00e1gina que vhost_net_build_xdp() asign\u00f3 para ella. tun_sendmsg() descarta ese -EINVAL y a\u00fan devuelve total_len, por lo que vhost_tx_batch() toma la ruta de \u00e9xito y nunca libera la p\u00e1gina; cada trama corta en un lote filtra un chunk de fragmento de p\u00e1gina.\n\nUn proceso local que puede abrir /dev/net/tun y /dev/vhost-net puede alcanzar esta ruta: adjunta un dispositivo tun/tap como el backend de vhost-net y alimenta descriptores TX cuya longitud menos el encabezado virtio-net est\u00e1 por debajo de ETH_HLEN. Cada kick filtra los chunks de fragmentos de p\u00e1gina para ese lote, y un bucle de env\u00edo ajustado agota la memoria del host y desencadena un p\u00e1nico OOM. Liberar la p\u00e1gina antes de devolver -EINVAL, coincidiendo con la ruta de error del programa XDP en la misma funci\u00f3n."
          }
        ],
        "id": "CVE-2026-46321",
        "lastModified": "2026-07-23T08:10:00.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 4.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-06-09T13:16:37.473",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0a6f46a9332ad6958992d64d3b3a81a80b2ca940"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0e8211fcf9426f5adddf32516ba0f400ceb9544d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/37a1c268c2c8090bf4dc552d732bd23ba36f8eb0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5b34f9e4fe2f203724a6e893d6df0316b9670057"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/69863ff2720a0e9871f1a5710f2a33a94217fee0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/98c67be9eb9de72465a071949e84a3cdb8fab5a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e915445942af6dcea628bf66d6241641201a0c41"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:45:31+00:00",
      "cve": "CVE-2026-46321",
      "id": "CVE-2026-46321",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tun: free page on short-frame rejection in tun_xdp_one()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46321.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.