CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one()
In the Linux kernel, the following vulnerability has been resolved:
tun: free page on buildskb failure in tunxdpone()
When buildskb() fails in tunxdpone(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhostnetbuildxdp() allocated for the frame. As with the short-frame rejection path, tunsendmsg() discards the per-buffer error and still returns totallen, so vhosttxbatch() takes the success path and never frees the page. Each buildskb() failure in a batch leaks one page-frag chunk.
Free the page before taking the error path, matching the putpage() the other error exits of tunxdpone() already perform.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
In tun_xdp_one(), free the page allocated for the frame before taking the error path when build_skb() fails, matching the put_page() behavior of the other error exits.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46322?
CVE-2026-46322 has a risk rating of 17, indicating a serious vulnerability in the Linux kernel.
How do I fix CVE-2026-46322?
To fix CVE-2026-46322, update your Linux kernel to the latest patched version provided by your Linux distribution.
What systems are affected by CVE-2026-46322?
CVE-2026-46322 affects systems running the Linux kernel that utilize the tun driver.
What is the nature of the vulnerability in CVE-2026-46322?
The vulnerability in CVE-2026-46322 involves a memory management issue where allocated pages are not freed on failure, potentially leading to resource leaks.
Is there any workaround for CVE-2026-46322 until a patch is applied?
Currently, no specific workaround is recommended for CVE-2026-46322, so updating the kernel is the best mitigation.