CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one()
In the Linux kernel, the following vulnerability has been resolved:
tun: free page on buildskb failure in tunxdpone()
When buildskb() fails in tunxdpone(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhostnetbuildxdp() allocated for the frame. As with the short-frame rejection path, tunsendmsg() discards the per-buffer error and still returns totallen, so vhosttxbatch() takes the success path and never frees the page. Each buildskb() failure in a batch leaks one page-frag chunk.
Free the page before taking the error path, matching the putpage() the other error exits of tunxdpone() already perform.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46322?
CVE-2026-46322 has a risk rating of 17, indicating a serious vulnerability in the Linux kernel.
How do I fix CVE-2026-46322?
To fix CVE-2026-46322, update your Linux kernel to the latest patched version provided by your Linux distribution.
What systems are affected by CVE-2026-46322?
CVE-2026-46322 affects systems running the Linux kernel that utilize the tun driver.
What is the nature of the vulnerability in CVE-2026-46322?
The vulnerability in CVE-2026-46322 involves a memory management issue where allocated pages are not freed on failure, potentially leading to resource leaks.
Is there any workaround for CVE-2026-46322 until a patch is applied?
Currently, no specific workaround is recommended for CVE-2026-46322, so updating the kernel is the best mitigation.