CVE-2026-46321

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the Linux kernel when the tun xdp one() function returns -EINVAL for frames shorter than ETH HLEN without freeing the page allocated by vhost net build xdp(). Because tun sendmsg() discards the -EINVAL error and returns the total length, vhost tx batch() assumes success and fails to free the page, leading to the leak of one page-frag chunk per short frame in a batch. A local process with access to '/dev/net/tun' and '/dev/vhost-net' can exploit this by attaching a tun/tap device as the vhost-net backend and submitting TX descriptors with lengths below ETH HLEN (excluding the virtio-net header). This can exhaust host memory and trigger an OOM (Out of Memory) panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.