CVE-2026-46321

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-46321

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46321.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-46321

Downstream

AZL (1)

AZL-89675

BELL (1)

BELL-CVE-2026-46321

DEBIAN (1)

DEBIAN-CVE-2026-46321

ECHO (1)

ECHO-8b8a-deb5-5414

OESA (2)

openSUSE (2)

ROOT (5)

SUSE (12)

UBUNTU (1)

Related

openSUSE (2)

SUSE (12)

Published

2026-06-09T12:11:13Z

Modified

2026-10-08T02:50:56Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVSS Calculator

Summary

tun: free page on short-frame rejection in tun_xdp_one()

Details

In the Linux kernel, the following vulnerability has been resolved:

tun: free page on short-frame rejection in tun_xdp_one()

tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk.

A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function.

Database specific

{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46321.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6100e0237204890269e3f934acfc50d35fd6f319

Fixed

0a6f46a9332ad6958992d64d3b3a81a80b2ca940

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2

Fixed

0e8211fcf9426f5adddf32516ba0f400ceb9544d

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146

Fixed

e915445942af6dcea628bf66d6241641201a0c41

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d5ad89b7d01ed4e66fd04734fc63d6e78536692a

Fixed

5b34f9e4fe2f203724a6e893d6df0316b9670057

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

049584807f1d797fc3078b68035450a9769eb5c3

Fixed

69863ff2720a0e9871f1a5710f2a33a94217fee0

Fixed

37a1c268c2c8090bf4dc552d732bd23ba36f8eb0

Fixed

98c67be9eb9de72465a071949e84a3cdb8fab5a3

Fixed

f4feb1e20058e407cb00f45aff47f5b7e19a6bbf

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.10.223

Fixed

5.10.259

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.15.164

Fixed

5.15.210

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.1.102

Fixed

6.1.176

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.6.43

Fixed

6.6.143

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.4.281

Fixed

5.5

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.9.12

Fixed

6.10

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.10.2

Fixed

6.11

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

32b0aaba5dbc85816898167d9b5d45a22eae82e9

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8418f55302fa1d2eeb73e16e345167e545c598a5

Affected versions

v5.*

v5.10.223

v5.10.224

v5.10.225

v5.10.226

v5.10.227

v5.10.228

v5.10.229

v5.10.230

v5.10.231

v5.10.232

v5.10.233

v5.10.234

v5.10.235

v5.10.236

v5.10.237

v5.10.238

v5.10.239

v5.10.240

v5.10.241

v5.10.242

v5.10.243

v5.10.244

v5.10.245

v5.10.246

v5.10.247

v5.10.248

v5.10.249

v5.10.250

v5.10.251

v5.10.252

v5.10.253

v5.10.254

v5.10.255

v5.10.256

v5.10.257

v5.10.258

v5.15.164

v5.15.165

v5.15.166

v5.15.167

v5.15.168

v5.15.169

v5.15.170

v5.15.171

v5.15.172

v5.15.173

v5.15.174

v5.15.175

v5.15.176

v5.15.177

v5.15.178

v5.15.179

v5.15.180

v5.15.181

v5.15.182

v5.15.183

v5.15.184

v5.15.185

v5.15.186

v5.15.187

v5.15.188

v5.15.189

v5.15.190

v5.15.191

v5.15.192

v5.15.193

v5.15.194

v5.15.195

v5.15.196

v5.15.197

v5.15.198

v5.15.199

v5.15.200

v5.15.201

v5.15.202

v5.15.203

v5.15.204

v5.15.205

v5.15.206

v5.15.207

v5.15.208

v5.15.209

v5.4.281

v5.4.282

v5.4.283

v5.4.284

v5.4.285

v5.4.286

v5.4.287

v5.4.288

v5.4.289

v5.4.290

v5.4.291

v5.4.292

v5.4.293

v5.4.294

v5.4.295

v5.4.296

v5.4.297

v5.4.298

v5.4.299

v5.4.300

v5.4.301

v5.4.302

v6.*

v6.1.102

v6.1.103

v6.1.104

v6.1.105

v6.1.106

v6.1.107

v6.1.108

v6.1.109

v6.1.110

v6.1.111

v6.1.112

v6.1.113

v6.1.114

v6.1.115

v6.1.116

v6.1.117

v6.1.118

v6.1.119

v6.1.120

v6.1.121

v6.1.122

v6.1.123

v6.1.124

v6.1.125

v6.1.126

v6.1.127

v6.1.128

v6.1.129

v6.1.130

v6.1.131

v6.1.132

v6.1.133

v6.1.134

v6.1.135

v6.1.136

v6.1.137

v6.1.138

v6.1.139

v6.1.140

v6.1.141

v6.1.142

v6.1.143

v6.1.144

v6.1.145

v6.1.146

v6.1.147

v6.1.148

v6.1.149

v6.1.150

v6.1.151

v6.1.152

v6.1.153

v6.1.154

v6.1.155

v6.1.156

v6.1.157

v6.1.158

v6.1.159

v6.1.160

v6.1.161

v6.1.162

v6.1.163

v6.1.164

v6.1.165

v6.1.166

v6.1.167

v6.1.168

v6.1.169

v6.1.170

v6.1.171

v6.1.172

v6.1.173

v6.1.174

v6.1.175

v6.10.10

v6.10.11

v6.10.12

v6.10.13

v6.10.14

v6.10.2

v6.10.3

v6.10.4

v6.10.5

v6.10.6

v6.10.7

v6.10.8

v6.10.9

v6.6.100

v6.6.101

v6.6.102

v6.6.103

v6.6.104

v6.6.105

v6.6.106

v6.6.107

v6.6.108

v6.6.109

v6.6.110

v6.6.111

v6.6.112

v6.6.113

v6.6.114

v6.6.115

v6.6.116

v6.6.117

v6.6.118

v6.6.119

v6.6.120

v6.6.121

v6.6.122

v6.6.123

v6.6.124

v6.6.125

v6.6.126

v6.6.127

v6.6.128

v6.6.129

v6.6.130

v6.6.131

v6.6.132

v6.6.133

v6.6.134

v6.6.135

v6.6.136

v6.6.137

v6.6.138

v6.6.139

v6.6.140

v6.6.141

v6.6.142

v6.6.43

v6.6.44

v6.6.45

v6.6.46

v6.6.47

v6.6.48

v6.6.49

v6.6.50

v6.6.51

v6.6.52

v6.6.53

v6.6.54

v6.6.55

v6.6.56

v6.6.57

v6.6.58

v6.6.59

v6.6.60

v6.6.61

v6.6.62

v6.6.63

v6.6.64

v6.6.65

v6.6.66

v6.6.67

v6.6.68

v6.6.69

v6.6.70

v6.6.71

v6.6.72

v6.6.73

v6.6.74

v6.6.75

v6.6.76

v6.6.77

v6.6.78

v6.6.79

v6.6.80

v6.6.81

v6.6.82

v6.6.83

v6.6.84

v6.6.85

v6.6.86

v6.6.87

v6.6.88

v6.6.89

v6.6.90

v6.6.91

v6.6.92

v6.6.93

v6.6.94

v6.6.95

v6.6.96

v6.6.97

v6.6.98

v6.6.99

v6.9.12

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46321.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.10.259

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.210

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.176

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.143

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.93

Type: ECOSYSTEM
Events: Introduced

6.11.0

Fixed

6.18.35

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

7.0.12

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46321.json"