Skip to main content

Linux Kernel EUVDEUVD-2026-35410

| CVE-2026-46320 HIGH
Memory Leak (CWE-401)
2026-06-09 Linux GHSA-xqcf-gwj9-5c88
Information Disclosure Linux
High
Disputed · 7.4 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Compromise or provision guest VM on vhost_net host
  2. Delivery
    Open virtio-net queue toward host tap
  3. Exploit
    Submit batch of sub-14-byte or alloc-failing frames
  4. Execution
    Trigger error path in tap_get_user_xdp() leaking page-frag
  5. Persist
    Repeat to exhaust host kernel memory
  6. Impact
    Degrade host networking and induce OOM

Vulnerability Assessment

Weakness
CWE
CWE-401
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Exploitation Conditions

Requires the attacker to be able to write malformed virtio-net buffers to a tap device through vhost_net - in practice this means controlling a guest VM on a KVM/QEMU host that uses vhost_net acceleration with the XDP fast-path, or having write access to a /dev/net/tun fd opened with IFF_VNET_HDR. The tap interface must be processing traffic through tap_get_user_xdp() (i.e., XDP is in use on the host's tap path). Limiting factors: AV:A means the attacker must be adjacent to the host's network stack rather than remote across the internet; impact is cumulative (one page-frag leaked per malformed frame in a batch) so noticeable damage requires sustained traffic; no code execution or data disclosure is possible (C:N/I:N), only availability impact (A:H) via memory exhaustion.
Impact

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H rates this 7.4 (High), driven entirely by availability impact and a scope change (host kernel memory affected from a guest/adjacent context). EPSS of 0.02% (5th percentile) and absence from CISA KEV indicate no observed exploitation. The realistic risk is moderate-to-low for most operators: triggering meaningful memory pressure requires sustained transmission of malformed frames from a vhost_net peer - typically a malicious or compromised VM guest - and the leak is one page-frag chunk per rejected frame, so impact accumulates over time rather than crashing instantly. The PR:N rating is technically correct for the kernel interface but conceptually misleading, because the attacker must already control a guest VM or have write access to a tap fd; defenders should treat this as a hardening fix for multi-tenant virtualization hosts rather than an internet-exposed flaw.
Exploit ScenarioDerived

A malicious or compromised KVM guest using vhost_net submits a batch of crafted virtio-net buffers whose payloads are shorter than 14 bytes (or sized to provoke build_skb() allocation failures under memory pressure), causing tap_get_user_xdp() to reject each frame without freeing its page-frag. Sustained transmission gradually exhausts host kernel page-frag memory, degrading host networking and eventually triggering OOM conditions that affect co-tenant VMs and host processes. No public exploit identified at time of analysis, but the trigger is mechanically trivial for anyone with raw access to a vhost_net peer.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 14, 2026

Denial-of-service via memory exhaustion in the Linux kernel's tap/vhost_net XDP path allows adjacent network attackers to leak kernel page-frag memory by sending malformed frames over a tap device. The bug in tap_get_user_xdp() fails to free pages allocated by vhost_net_build_xdp() on the error paths for undersized frames (<ETH_HLEN) and build_skb() allocation failures, with each rejected frame in a batch leaking one page-frag chunk. EPSS is 0.02% and no public exploit identified at time of analysis; not listed in CISA KEV.

RemediationAI

Vendor-released patch: Linux stable 7.0.12 and 7.1-rc6 contain the fix; upgrade affected kernels by applying the commits 18a84c3 and 3bcf7ae from https://git.kernel.org/stable/c/18a84c35842e19cd3c5534d8cee73d31863f696d and https://git.kernel.org/stable/c/3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2, or roll forward to a distribution kernel that has backported these stable patches. Where immediate kernel updates are not feasible on virtualization hosts, compensating controls include disabling the XDP fast-path on tap interfaces used by vhost_net (which removes the affected code path but reduces guest network throughput), restricting which users can open /dev/vhost-net and /dev/net/tun (limits attackers to those who already have permitted guest access), and monitoring host slab/page-frag consumption per-VM via /proc/meminfo and cgroup memory accounting to detect leak-driven growth so operators can restart the offending qemu process before OOM. Avoid exposing tap fds to untrusted local users.

Affected VersionsENISA

Linux patch: 7.0.12
Linux patch: 7.1-rc6
Linux patch: 0
Linux 4.20
Linux 0efac27791ee068075d80f07c55a229b1335ce12 <18a84c35842e19cd3c5534d8cee73d31863f696d
Linux 0efac27791ee068075d80f07c55a229b1335ce12 <3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in drivers/net/tap.c within the XDP (eXpress Data Path) fast-path used by vhost_net to forward packets from userspace (typically QEMU/KVM guests) into the host's tap device. vhost_net_build_xdp() allocates a page-frag for each incoming buffer, and tap_get_user_xdp() is expected to consume or free that page. On two error paths - frame length shorter than ETH_HLEN (14 bytes) returning -EINVAL, and build_skb() returning -ENOMEM - the code jumped to the err label without releasing the page. Compounding this, tap_sendmsg() always returns 0 regardless of the per-buffer result, so vhost_tx_batch() treats the batch as successful and never reclaims the leaked pages. The root cause class is a missing-resource-release on error (CWE-401 memory leak), and the fix mirrors the analogous earlier correction in tun_xdp_one().

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY 7.4 HIGH
AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
vuln.today AI 6.5 MEDIUM

Trigger requires local control of a vhost_net peer (guest VM or tap fd holder), so AV:L and PR:L; leaked host kernel memory crosses a trust boundary giving S:C and A:H, with no C/I impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE 3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 14, 2026 - 06:22 NVD
7.4 (HIGH)
Patch available
Jun 09, 2026 - 14:01 EUVD
CVE Published
Jun 09, 2026 - 12:11 cve.org
HIGH 7.4
CVE Published
Jun 09, 2026 - 12:11 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tap: free page on error paths in tap_get_user_xdp()

tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk.

Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().

Executive ViewAI

Why It Matters

CVE-2026-46320 is a high-severity denial-of-service vulnerability in the Linux kernel's virtual networking layer that could be exploited by adjacent network attackers to cause infrastructure unavailability through memory exhaustion. While no public exploit code has been identified to date, the attack surface spans any organization operating KVM or container hypervisors with vhost_net networking enabled. Immediate kernel patching is available and strongly recommended to prevent potential network-based attacks against virtualized infrastructure.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
1
1 sources
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact
High

Priority Score

47
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +37
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Memory and Network Vulnerabilities

View all 20
CVE-2026-46316 CRITICAL
9.3
CVE-2026-46327 HIGH
7.8
CVE-2026-46330 HIGH
7.8
CVE-2026-46325 CRITICAL
9.8
CVE-2026-46323 HIGH
7.8
CVE-2026-46322 HIGH
7.1
CVE-2026-46332 HIGH
8.0
CVE-2026-46321 HIGH
7.1
CVE-2026-46328 HIGH
7.3
CVE-2026-52907 HIGH
7.8
CVE-2026-46317 HIGH
8.8
CVE-2026-46318 MEDIUM
5.5
CVE-2026-46319 HIGH
7.8
CVE-2026-46324 HIGH
7.8
CVE-2026-46326 HIGH
8.4
CVE-2026-46329 MEDIUM
5.5
CVE-2026-52904 MEDIUM
5.5
CVE-2026-52905 MEDIUM
5.5
CVE-2026-52906 HIGH
7.7

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2020-6079 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Low
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46320 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/369521 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/18a84c35842e19cd3c5534d8cee73d31863f696d REF https://git.kernel.org/stable/c/3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2 REF https://git.kernel.org/stable/c/3f52a86a482a69294c50a5a2a097bd6f4104990a REF https://git.kernel.org/stable/c/8d03e65eb6cfbffec471a6b65416f93679bf3286 REF https://git.kernel.org/stable/c/d30aac0fa00ca0afc3e08174cf7f974a66bdcf05 REF https://git.kernel.org/stable/c/d68eab61944a9b0826fa2e954e42db1aa3201b7a REF https://git.kernel.org/stable/c/e27c17346628cb56843a83f93ac63c314c00f388 REF https://git.kernel.org/stable/c/f979971835dddbca86cf99e3b2e2b94a408a1ab2

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy