CVE-2026-46153: 8021q: delete cleared egress QoS mappings
In the Linux kernel, the following vulnerability has been resolved:
8021q: delete cleared egress QoS mappings
vlandevsetegresspriority() currently keeps cleared egress priority mappings in the hash as tombstones. Repeated set/clear cycles with distinct skb priorities therefore accumulate mapping nodes until device teardown and leak memory.
Delete mappings when vlanprio is cleared instead of keeping tombstones. Now that the egress mapping lists are RCU protected, the node can be unlinked safely and freed after a grace period.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this issue?
Linux systems that repeatedly set and clear VLAN egress QoS mappings using distinct skb priorities are exposed. The impact is memory accumulation until the affected VLAN device is torn down.
What access does an attacker need to exploit it?
The CVSS vector indicates local access with low privileges and no user interaction is required. Exploitation depends on being able to trigger repeated egress priority mapping set/clear cycles.
Is there a workaround if patching is delayed?
Avoid repeated set/clear cycles for VLAN egress QoS mappings with distinct skb priorities. Tearing down the affected VLAN device releases the accumulated mapping nodes.
How can I tell whether a system may be affected?
Review whether VLAN egress QoS mappings are being repeatedly created and cleared with varying skb priorities. Systems exhibiting memory growth during such cycles may be affected.