Skip to main content

Linux Kernel EUVDEUVD-2026-35411

| CVE-2026-46321 HIGH
2026-06-09 Linux GHSA-3qqh-vm6g-ghw6
Information Disclosure Linux
7.1
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local shell on host
  2. Delivery
    Open /dev/net/tun and /dev/vhost-net
  3. Exploit
    Attach tun/tap as vhost-net backend
  4. Execution
    Submit batch of sub-ETH_HLEN TX descriptors
  5. Persist
    Loop submissions to leak page-frags
  6. Impact
    Exhaust host memory and trigger OOM panic

Vulnerability Assessment

Exploitation Conditions

Attacker must be a local process able to open both /dev/net/tun and /dev/vhost-net and attach the tun/tap device as the vhost-net backend; the trigger is feeding a batch of TX descriptors whose frame length minus the virtio-net header is below ETH_HLEN (14 bytes) so tun_xdp_one() takes the short-frame -EINVAL branch. Limiting factors: the target kernel must include the vhost-net XDP fast path (introduced around 5.4 and present through 6.11), and on default distribution installs /dev/net/tun and /dev/vhost-net require root, CAP_NET_ADMIN, or membership in a dedicated group (kvm/tun) - so unprivileged users on hardened hosts cannot reach the code path despite the CVSS PR:N rating, while container, KubeVirt, or VPS environments that expose these nodes to tenants are directly exposed.
Impact

CVSS 3.1 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) reflects a high availability impact reachable only locally but with a scope change because a single unprivileged process can exhaust kernel memory and panic the whole host - the scope-change is what pushes this above a typical local DoS. EPSS is 0.02% (5th percentile) and the vulnerability is not in CISA KEV, consistent with a kernel memory-leak that requires a tight local submission loop rather than remote attack surface. Note the CVSS vector lists PR:N, but real exploitation requires the attacker to open /dev/net/tun and /dev/vhost-net, which on most distributions is gated by root, CAP_NET_ADMIN, or membership in a kvm/tun group - defenders on hardened multi-tenant hosts (containers, VPS, KubeVirt/QEMU nodes) where unprivileged users can access these device nodes should treat this as a real priority, while single-tenant servers face minimal exposure.
Exploit ScenarioDerived

A local user on a multi-tenant Linux host that grants access to /dev/net/tun and /dev/vhost-net (for example a container or VPS guest with relaxed device permissions) opens both devices, attaches a tun/tap device as the vhost-net backend, and submits TX descriptors crafted so that length minus the virtio-net header is under 14 bytes. In a tight submission loop each rejected short frame leaks one page-frag chunk; within seconds host memory is exhausted, the OOM killer fires, and the kernel panics, taking every tenant on the box offline. No public exploit identified at time of analysis, but the trigger is a few lines of code given the reproducer described in the patch.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 14, 2026

Local denial-of-service in the Linux kernel's tun/vhost-net subsystem allows an unprivileged process with access to /dev/net/tun and /dev/vhost-net to leak page-frag chunks on every short frame (length minus virtio-net header below ETH_HLEN) submitted to tun_xdp_one(), eventually exhausting host memory and triggering an OOM panic. The flaw is a missing put_page() on the -EINVAL error path that tun_sendmsg() then masks by reporting success to vhost_tx_batch(). EPSS is very low (0.02%) and no public exploit identified at time of analysis, but the bug is upstream-confirmed with patches in stable trees.

RemediationAI

Vendor-released patch: upgrade to a kernel containing the stable backports - 5.4.281+, 5.10.223+, 5.15.164+, 6.1.102+, 6.6.43+, 6.9.12+, 6.10.2+, 6.12.93+, or 6.18.35+ - using the upstream commits at https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf and the companion stable trees (69863ff2720a, 37a1c268c2c8, 98c67be9eb9d) referenced in the CVE record. Until kernels are rebooted into the patched build, restrict access to /dev/net/tun and /dev/vhost-net by tightening udev rules or group ownership so that only trusted accounts (typically root, kvm, or libvirt-managed users) can open them - note this will break unprivileged userspace VMMs or container networking that legitimately rely on these nodes. On hypervisor hosts you can also disable vhost-net acceleration in QEMU/libvirt (vhost=off) to remove the vulnerable code path at the cost of measurably higher virtio-net CPU overhead and latency. See https://nvd.nist.gov/vuln/detail/CVE-2026-46321 and https://vuldb.com/vuln/369526 for tracking.

Affected VersionsENISA

Linux patch: 7.1-rc6
Linux 5.10.223 <5.11
Linux 049584807f1d797fc3078b68035450a9769eb5c3 <f4feb1e20058e407cb00f45aff47f5b7e19a6bbf
Linux 049584807f1d797fc3078b68035450a9769eb5c3 <69863ff2720a0e9871f1a5710f2a33a94217fee0
Linux 049584807f1d797fc3078b68035450a9769eb5c3 <37a1c268c2c8090bf4dc552d732bd23ba36f8eb0
Linux 6.11
Linux 589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2
Linux 6.10.2 <6.11
Linux patch: 7.0.12
Linux 5.15.164 <5.16
Linux a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb
Linux patch: 6.12.93
Linux 5.4.281 <5.5
Linux 6100e0237204890269e3f934acfc50d35fd6f319
Linux ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146
Linux 6.6.43 <6.7
Linux 6.9.12 <6.10
Linux d5ad89b7d01ed4e66fd04734fc63d6e78536692a
Linux 049584807f1d797fc3078b68035450a9769eb5c3 <98c67be9eb9de72465a071949e84a3cdb8fab5a3
Linux 6.1.102 <6.2
Linux 32b0aaba5dbc85816898167d9b5d45a22eae82e9
Linux patch: 0
Linux 8418f55302fa1d2eeb73e16e345167e545c598a5
Linux patch: 6.18.35

Affected Packages

euvd linux fix: 5.5, 5.11, 5.16, 6.2, 6.7, 6.10, 6.11

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The defect lives in drivers/net/tun.c, specifically tun_xdp_one(), which validates XDP-fed frames coming from vhost_net's batched TX path. vhost_net_build_xdp() pre-allocates a page-frag buffer to hold the frame; when tun_xdp_one() finds the frame is smaller than ETH_HLEN (14 bytes) it short-circuits with -EINVAL but never calls put_page() on the buffer, while the working XDP-program error branch in the same function does free it. tun_sendmsg() then swallows the -EINVAL and returns total_len, so vhost_tx_batch() believes the batch succeeded and never reclaims the buffer. Root cause is a classic missing-release-on-error-path memory leak (CWE-401/CWE-772 class), made reachable because tun and vhost-net device nodes are user-facing character devices when accessible.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
vuln.today AI 6.5 MEDIUM

Local trigger via tun/vhost-net device nodes that normally require a privileged group, so PR:L rather than PR:N; reliable kernel-wide OOM panic gives A:H and S:C, with no C/I impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 14, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Jun 09, 2026 - 14:01 EUVD
CVE Published
Jun 09, 2026 - 12:11 cve.org
HIGH 7.1
CVE Published
Jun 09, 2026 - 12:11 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tun: free page on short-frame rejection in tun_xdp_one()

tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk.

A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function.

Executive ViewAI

Why It Matters

A denial-of-service vulnerability in Linux kernel networking (CVE-2026-46321) can trigger system crashes in virtualized and containerized environments. Exploitation requires local access with specific device permissions and no public exploits have been identified, making this a manageable risk with available patches.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
1
1 sources
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Memory and Network Vulnerabilities

View all 20
CVE-2026-46316 CRITICAL
9.3
CVE-2026-46327 HIGH
7.8
CVE-2026-46330 HIGH
7.8
CVE-2026-46325 CRITICAL
9.8
CVE-2026-46323 HIGH
7.8
CVE-2026-46320 HIGH
7.4
CVE-2026-46322 HIGH
7.1
CVE-2026-46332 HIGH
8.0
CVE-2026-46328 HIGH
7.3
CVE-2026-52907 HIGH
7.8
CVE-2026-46317 HIGH
8.8
CVE-2026-46318 MEDIUM
5.5
CVE-2026-46319 HIGH
7.8
CVE-2026-46324 HIGH
7.8
CVE-2026-46326 HIGH
8.4
CVE-2026-46329 MEDIUM
5.5
CVE-2026-52904 MEDIUM
5.5
CVE-2026-52905 MEDIUM
5.5
CVE-2026-52906 HIGH
7.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46321 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/369526 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/0a6f46a9332ad6958992d64d3b3a81a80b2ca940 REF https://git.kernel.org/stable/c/0e8211fcf9426f5adddf32516ba0f400ceb9544d REF https://git.kernel.org/stable/c/37a1c268c2c8090bf4dc552d732bd23ba36f8eb0 REF https://git.kernel.org/stable/c/5b34f9e4fe2f203724a6e893d6df0316b9670057 REF https://git.kernel.org/stable/c/69863ff2720a0e9871f1a5710f2a33a94217fee0 REF https://git.kernel.org/stable/c/98c67be9eb9de72465a071949e84a3cdb8fab5a3 REF https://git.kernel.org/stable/c/e915445942af6dcea628bf66d6241641201a0c41 REF https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy