SB2026061016 - Memory leak in Linux kernel net driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-46321)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in tun_xdp_one() in the tun driver when processing short frames through the tun and vhost-net transmit path. A local user can submit TX descriptors whose payload length is shorter than ETH_HLEN to exhaust host memory and trigger an OOM panic.

Exploitation requires the ability to open /dev/net/tun and /dev/vhost-net and to attach a tun/tap device as the vhost-net backend.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/37a1c268c2c8090bf4dc552d732bd23ba36f8eb0
• https://git.kernel.org/stable/c/69863ff2720a0e9871f1a5710f2a33a94217fee0
• https://git.kernel.org/stable/c/98c67be9eb9de72465a071949e84a3cdb8fab5a3
• https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf