High severity7.4NVD Advisory· Published Jun 9, 2026· Updated Oct 19, 2026
CVE-2026-46320
CVE-2026-46320
Description
In the Linux kernel, the following vulnerability has been resolved:
tap: free page on error paths in tap_get_user_xdp()
tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk.
Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
28(expand)+ 6 more
- (no CPE)
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=4.20,<5.10.259
- cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*
- osv-coords21 versionspkg:apk/chainguard/linux-qemu-melangepkg:apk/chainguard/linux-gcp-6.18pkg:rpm/opensuse/kernel-azure&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default-base&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-build&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-qa&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-rt&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/linux-azure-6.18pkg:apk/chainguard/linux-gcp-6.18-bootc-boot-installedpkg:apk/chainguard/linux-qemu-6.18pkg:rpm/opensuse/kernel-zfcpdump&distro=openSUSE%20Leap%2016.0pkg:linux/kernelpkg:rpm/opensuse/kernel-default&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-docs&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/linux-qemu-6.18-bootc-boot-installedpkg:rpm/opensuse/kernel-kvmsmall&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/dtb-aarch64&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/kernel-syms&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-64kb&distro=openSUSE%20Leap%2016.0
< 6.18.38-r0+ 20 more
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1.160000.2.17
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: >= 4.20.0, < 5.10.259
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.18.38-r0
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 7.0.12-1.1
- (no CPE)range: < 6.12.0-160000.36.1
- (no CPE)range: < 6.12.0-160000.36.1
Patches
Vulnerability mechanics
References
9- git.kernel.org/stable/c/18a84c35842e19cd3c5534d8cee73d31863f696dnvdPatch
- git.kernel.org/stable/c/3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2nvdPatch
- git.kernel.org/stable/c/3f52a86a482a69294c50a5a2a097bd6f4104990anvdPatch
- git.kernel.org/stable/c/8d03e65eb6cfbffec471a6b65416f93679bf3286nvdPatch
- git.kernel.org/stable/c/d30aac0fa00ca0afc3e08174cf7f974a66bdcf05nvdPatch
- git.kernel.org/stable/c/d68eab61944a9b0826fa2e954e42db1aa3201b7anvdPatch
- git.kernel.org/stable/c/e27c17346628cb56843a83f93ac63c314c00f388nvdPatch
- git.kernel.org/stable/c/f979971835dddbca86cf99e3b2e2b94a408a1ab2nvdPatch
- cert-portal.siemens.com/productcert/html/ssa-784472.htmlnvd
News mentions
2- Linux Kernel: 25 Vulnerabilities Disclosed in Single Batch on June 8-9, 2026Vypr Intelligence · Jun 9, 2026
- Siemens SIMATIC S7-1500 TM MFPCISA ICS Advisories