CVE-2026-46320

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the tap get user xdp() function. When a frame is shorter than ETH HLEN, the function returns -EINVAL; similarly, it returns -ENOMEM if build skb() fails. In both scenarios, the process jumps to an error label without freeing the page previously allocated by vhost net build xdp(). Because tap sendmsg() ignores the per-buffer return value and always returns 0, vhost tx batch() assumes success and fails to free the page, resulting in the leak of one page-frag chunk for every rejected frame in a batch.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.