Vulnerability-Lookup

FKIE_CVE-2026-46322

Vulnerability from fkie_nvd - Published: 2026-06-09 13:16 - Updated: 2026-10-19 20:18

Severity

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2638a9c1521905bb5c5d1e95c8fbc09f79148ed7	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4fefc6156a162a9f50035c12091a5e5130c82c6e	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/60d9c0d6cdde5420d6483c921b16fe5465eb5238	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/793385c154771603b8671dd8338927221e9d8d78	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5	Patch
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "793385c154771603b8671dd8338927221e9d8d78",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "2638a9c1521905bb5c5d1e95c8fbc09f79148ed7",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "60d9c0d6cdde5420d6483c921b16fe5465eb5238",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "d16e38fac09a47bfcf98c1ad65a1bb53f94540f5",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "aa308e9dbb9acb17cacdbbce9e4504f69bac8385",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "4fefc6156a162a9f50035c12091a5e5130c82c6e",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "aa8963fdce667a42fb7f0bdd2909fadcab02f9a8",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E9DE7899-6954-4BE5-89B6-A96342AF8401",
              "versionEndExcluding": "5.10.259",
              "versionStartIncluding": "4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
              "versionEndExcluding": "5.15.210",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
              "versionEndExcluding": "6.1.176",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
              "versionEndExcluding": "6.6.143",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63",
              "versionEndExcluding": "6.12.93",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382",
              "versionEndExcluding": "6.18.35",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3",
              "versionEndExcluding": "7.0.12",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on build_skb failure in tun_xdp_one()\n\nWhen build_skb() fails in tun_xdp_one(), the function sets ret to\n-ENOMEM and jumps to the out label, which returns without freeing the\npage that vhost_net_build_xdp() allocated for the frame. As with the\nshort-frame rejection path, tun_sendmsg() discards the per-buffer error\nand still returns total_len, so vhost_tx_batch() takes the success path\nand never frees the page. Each build_skb() failure in a batch leaks one\npage-frag chunk.\n\nFree the page before taking the error path, matching the put_page() the\nother error exits of tun_xdp_one() already perform."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntun: liberar p\u00e1gina en caso de fallo de build_skb() en tun_xdp_one()\n\nCuando build_skb() falla en tun_xdp_one(), la funci\u00f3n establece ret en -ENOMEM y salta a la etiqueta out, la cual retorna sin liberar la p\u00e1gina que vhost_net_build_xdp() asign\u00f3 para el frame. Al igual que con la ruta de rechazo de frames cortos, tun_sendmsg() descarta el error por b\u00fafer y a\u00fan retorna total_len, por lo que vhost_tx_batch() toma la ruta de \u00e9xito y nunca libera la p\u00e1gina. Cada fallo de build_skb() en un lote fuga un fragmento de p\u00e1gina.\n\nLiberar la p\u00e1gina antes de tomar la ruta de error, coincidiendo con el put_page() que las otras salidas de error de tun_xdp_one() ya realizan."
    }
  ],
  "id": "CVE-2026-46322",
  "lastModified": "2026-10-19T20:18:43.000",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 4.0,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-46322",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-16T15:22:05.058396Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T13:16:37.603",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2638a9c1521905bb5c5d1e95c8fbc09f79148ed7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4fefc6156a162a9f50035c12091a5e5130c82c6e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/60d9c0d6cdde5420d6483c921b16fe5465eb5238"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/793385c154771603b8671dd8338927221e9d8d78"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5"
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CVE-2026-46322 (GCVE-0-2026-46322)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:11 – Updated: 2026-10-19 19:36

Title

tun: free page on build_skb failure in tun_xdp_one()

Summary

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:22 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

9 references

URL	Tags
https://git.kernel.org/stable/c/26fe549b5192536b6…
https://git.kernel.org/stable/c/793385c154771603b…
https://git.kernel.org/stable/c/2638a9c1521905bb5…
https://git.kernel.org/stable/c/60d9c0d6cdde5420d…
https://git.kernel.org/stable/c/d16e38fac09a47bfc…
https://git.kernel.org/stable/c/aa308e9dbb9acb17c…
https://git.kernel.org/stable/c/4fefc6156a162a9f5…
https://git.kernel.org/stable/c/aa8963fdce667a42f…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 793385c154771603b8671dd8338927221e9d8d78 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 2638a9c1521905bb5c5d1e95c8fbc09f79148ed7 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 60d9c0d6cdde5420d6483c921b16fe5465eb5238 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < d16e38fac09a47bfcf98c1ad65a1bb53f94540f5 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < aa308e9dbb9acb17cacdbbce9e4504f69bac8385 (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < 4fefc6156a162a9f50035c12091a5e5130c82c6e (git) Affected: 043d222f93ab8c76b56a3b315cd8692e35affb6c , < aa8963fdce667a42fb7f0bdd2909fadcab02f9a8 (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:21:37.036Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46322",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:22:05.058396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:36:58.325Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "793385c154771603b8671dd8338927221e9d8d78",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "2638a9c1521905bb5c5d1e95c8fbc09f79148ed7",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "60d9c0d6cdde5420d6483c921b16fe5465eb5238",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "d16e38fac09a47bfcf98c1ad65a1bb53f94540f5",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "aa308e9dbb9acb17cacdbbce9e4504f69bac8385",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "4fefc6156a162a9f50035c12091a5e5130c82c6e",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            },
            {
              "lessThan": "aa8963fdce667a42fb7f0bdd2909fadcab02f9a8",
              "status": "affected",
              "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on build_skb failure in tun_xdp_one()\n\nWhen build_skb() fails in tun_xdp_one(), the function sets ret to\n-ENOMEM and jumps to the out label, which returns without freeing the\npage that vhost_net_build_xdp() allocated for the frame. As with the\nshort-frame rejection path, tun_sendmsg() discards the per-buffer error\nand still returns total_len, so vhost_tx_batch() takes the success path\nand never frees the page. Each build_skb() failure in a batch leaks one\npage-frag chunk.\n\nFree the page before taking the error path, matching the put_page() the\nother error exits of tun_xdp_one() already perform."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the TUN `sendmsg()` path with `TUN_MSG_PTR`, which in production is driven by host `vhost-net` processing virtio-net TX descriptors from a VM guest or a local process holding a TUN/vhost-net fd\u2014not by the host parsing remote network packets.\nAC:L - An attacker can reliably trigger `build_skb()` failure by first pressuring the `sk_buff` slab (e.g., flooding virtio TX or other allocations) and then sending batched virtio TX frames; they control both the memory-pressure side and the batch submission side.\nPR:N - In the highest-impact scenario\u2014a malicious tenant in a cloud/KVM guest with virtio-net and vhost-net\u2014the attacker needs no host privileges; any guest process that can transmit on the virtio TX queue can drive this path.\nUI:N - Exploitation requires no victim interaction beyond normal VM networking; the guest attacker can trigger the leak programmatically without the host user performing any action.\nS:C - The leak consumes host kernel memory from a guest VM security context, crossing the VM/host boundary and impacting resources outside the attacker\u0027s guest security authority.\nC:N - This is a pure page reference leak with no out-of-bounds access, use-after-free, or attacker-readable disclosure; leaked pages remain in the kernel allocator and are not exposed to the attacker.\nI:N - No memory corruption, arbitrary write, or control-flow hijack occurs; the only defect is failing to `put_page()` on the `build_skb()` error path.\nA:H - Each failed `build_skb()` leaks a page-frag (~4 KiB), batches can hold up to 64 XDP buffers, and `tun_sendmsg()` masks per-buffer errors so leaks are unbounded and repeatable, enabling sustained host kernel memory exhaustion and OOM/DoS."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:17.322Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/793385c154771603b8671dd8338927221e9d8d78"
        },
        {
          "url": "https://git.kernel.org/stable/c/2638a9c1521905bb5c5d1e95c8fbc09f79148ed7"
        },
        {
          "url": "https://git.kernel.org/stable/c/60d9c0d6cdde5420d6483c921b16fe5465eb5238"
        },
        {
          "url": "https://git.kernel.org/stable/c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fefc6156a162a9f50035c12091a5e5130c82c6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8"
        }
      ],
      "title": "tun: free page on build_skb failure in tun_xdp_one()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46322",
    "datePublished": "2026-06-09T12:11:14.776Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-10-19T19:36:58.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted