7.1
HIGH
CVSS 3.1
CVE-2026-46322
tun: free page on build_skb failure in tun_xdp_one()
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform.
Details
INFO
Published Date :
June 9, 2026, 1:16 p.m.
Last Modified :
July 23, 2026, 8:10 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
Free allocated pages on build_skb failure to prevent memory leaks.
- Free the page before returning on build_skb failure.
- Ensure page is freed on all error exits.
- Match existing put_page() calls on error paths.
Public PoC/Exploit Available at Github
CVE-2026-46322 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46322.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46322 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46322
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
Updated: 1 week, 1 day ago
0 stars
0 fork
0 watcher
Born at : July 8, 2025, 4:34 a.m.
This repo has been linked 79 different CVEs too.
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46322 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46322 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: el kernel de Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: tun: liberar página en caso de fallo de build_skb() en tun_xdp_one() Cuando build_skb() falla en tun_xdp_one(), la función establece ret en -ENOMEM y salta a la etiqueta out, la cual retorna sin liberar la página que vhost_net_build_xdp() asignó para el frame. Al igual que con la ruta de rechazo de frames cortos, tun_sendmsg() descarta el error por búfer y aún retorna total_len, por lo que vhost_tx_batch() toma la ruta de éxito y nunca libera la página. Cada fallo de build_skb() en un lote fuga un fragmento de página. Liberar la página antes de tomar la ruta de error, coincidiendo con el put_page() que las otras salidas de error de tun_xdp_one() ya realizan. -
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.176 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.35 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.93 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.210 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.10.259 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.12 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2638a9c1521905bb5c5d1e95c8fbc09f79148ed7 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4fefc6156a162a9f50035c12091a5e5130c82c6e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/60d9c0d6cdde5420d6483c921b16fe5465eb5238 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/793385c154771603b8671dd8338927221e9d8d78 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 19, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/2638a9c1521905bb5c5d1e95c8fbc09f79148ed7 Added Reference https://git.kernel.org/stable/c/26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9 Added Reference https://git.kernel.org/stable/c/60d9c0d6cdde5420d6483c921b16fe5465eb5238 Added Reference https://git.kernel.org/stable/c/793385c154771603b8671dd8338927221e9d8d78 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': 'd16e38fac09a47bfcf98c1ad65a1bb53f94540f5', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': 'aa308e9dbb9acb17cacdbbce9e4504f69bac8385', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': '4fefc6156a162a9f50035c12091a5e5130c82c6e', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': 'aa8963fdce667a42fb7f0bdd2909fadcab02f9a8', 'versionType': 'git'}], 'programFiles': ['drivers/net/tun.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.20'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.20', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/tun.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': '26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': '793385c154771603b8671dd8338927221e9d8d78', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': '2638a9c1521905bb5c5d1e95c8fbc09f79148ed7', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': '60d9c0d6cdde5420d6483c921b16fe5465eb5238', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': 'd16e38fac09a47bfcf98c1ad65a1bb53f94540f5', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': 'aa308e9dbb9acb17cacdbbce9e4504f69bac8385', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': '4fefc6156a162a9f50035c12091a5e5130c82c6e', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': 'aa8963fdce667a42fb7f0bdd2909fadcab02f9a8', 'versionType': 'git'}], 'programFiles': ['drivers/net/tun.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.20'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.20', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/tun.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': 'd16e38fac09a47bfcf98c1ad65a1bb53f94540f5', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': 'aa308e9dbb9acb17cacdbbce9e4504f69bac8385', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': '4fefc6156a162a9f50035c12091a5e5130c82c6e', 'versionType': 'git'}, {'status': 'affected', 'version': '043d222f93ab8c76b56a3b315cd8692e35affb6c', 'lessThan': 'aa8963fdce667a42fb7f0bdd2909fadcab02f9a8', 'versionType': 'git'}], 'programFiles': ['drivers/net/tun.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.20'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.20', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/tun.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 14, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 09, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform. Added Reference https://git.kernel.org/stable/c/4fefc6156a162a9f50035c12091a5e5130c82c6e Added Reference https://git.kernel.org/stable/c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385 Added Reference https://git.kernel.org/stable/c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8 Added Reference https://git.kernel.org/stable/c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.