AZL-89678
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-89678.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-89678
- Upstream
- Published
- 2026-06-09T13:16:37Z
- Modified
- 2026-08-28T17:48:10.896105283Z
- Summary
- CVE-2026-46322 affecting package kernel for versions less than 6.6.143.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
tun: free page on buildskb failure in tunxdp_one()
When buildskb() fails in tunxdpone(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhostnetbuildxdp() allocated for the frame. As with the short-frame rejection path, tunsendmsg() discards the per-buffer error and still returns totallen, so vhosttxbatch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk.
Free the page before taking the error path, matching the putpage() the other error exits of tunxdp_one() already perform.
- References