Linux Kernel CVE-2026-46153

Exploitation requires local system access and CAP_NET_ADMIN capability (or equivalent root-level privilege) to configure VLAN network interfaces. The target system must have one or more 802.1Q VLAN devices present, and the attacker must be able to issue repeated vlan_dev_set_egress_priority() calls - practically via ip link set with egress-qos-map - using distinct skb priority values across set/clear cycles to accumulate tombstones. Systems without VLAN (802.1Q) devices, or environments where network interface configuration is strictly restricted to root administrators, are not practically exploitable. The 'Information Disclosure' tag appearing in source intelligence is inconsistent with both the CVSS C:N vector and the vulnerability description; no confidentiality condition applies. Exploitation impact is limited to the local host and does not enable lateral movement or privilege escalation.

CVSS 5.5 Medium with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H correctly frames this as a local, low-complexity issue requiring only low privileges with no user interaction, yielding High availability impact through memory exhaustion. EPSS at 0.02% (5th percentile) confirms very low exploitation probability, and there is no CISA KEV entry, indicating no confirmed active exploitation. No public POC has been identified. The real-world priority is low: exploitation requires local access plus the ability to issue repeated VLAN interface configuration calls, which in practice requires CAP_NET_ADMIN or equivalent. Notably, the source intelligence tags this as 'Information Disclosure,' which directly conflicts with the CVSS C:N vector and the vulnerability description - no confidentiality leak is described or supported by available data. This tag should be treated as erroneous metadata. For systems running VLAN infrastructure with untrusted local users, the availability risk is real but requires sustained deliberate triggering rather than passive exposure.

A local user with CAP_NET_ADMIN capability on a host running 802.1Q VLAN interfaces writes a loop that repeatedly calls ip link set <vlan-dev> type vlan egress-qos-map <skb-prio> <vlan-prio> followed by a clear operation, cycling through distinct skb priority values. Each cycle adds an unreleased tombstone node to the kernel hash table; over thousands of iterations, kernel memory is exhausted, triggering the OOM killer or causing system-wide instability. No public POC exists for this specific scenario at time of analysis.