Skip to main content

Linux Kernel EUVDEUVD-2026-35412

| CVE-2026-46322 HIGH
Memory Leak (CWE-401)
2026-06-09 Linux GHSA-3r6q-v9jg-jvv4
Information Disclosure Linux
High
Disputed · 7.1 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local/guest execution with tap access
  2. Delivery
    Attach XDP program to vhost-net tap
  3. Exploit
    Generate sustained packet bursts under memory pressure
  4. Execution
    Trigger repeated build_skb() failures in tun_xdp_one()
  5. Persist
    Leak one page-frag per failure across batches
  6. Impact
    Exhaust host memory and degrade availability

Vulnerability Assessment

Weakness
CWE
CWE-401
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Exploitation Conditions

Requires local access to a workload that can drive the TUN/vhost-net XDP transmit path - in practice a KVM/QEMU guest using a vhost-net-backed tap with XDP enabled, or a container/process with CAP_NET_ADMIN that can open /dev/net/tun and attach an XDP program. The bug only fires when build_skb() actually fails inside tun_xdp_one(), which generally needs the host to be near memory exhaustion or otherwise unable to satisfy the small skb allocation; on a well-provisioned, lightly loaded host the leak path is rarely taken. Hosts not using vhost-net XDP batching (e.g., userspace virtio backends, pre-4.20 kernels without commit 043d222f93ab, or tap interfaces with no XDP program attached) are not exposed.
Impact

Signals are consistent and point to a low-urgency local availability issue. The CVSS vector AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H scores 7.1 primarily because of the scope change (a guest VM or unprivileged container can affect the host) and high availability impact; there is no confidentiality or integrity exposure. EPSS is 0.02% (5th percentile) and no public exploit is identified, which matches the nature of the bug - a slow page-frag leak triggered only when build_skb() fails, which itself usually requires the host to already be under memory pressure. The PR:N rating in combination with AV:L should be read as 'an unprivileged local actor (including a guest with a vhost-net-backed tap)' rather than 'remote' - verify in your environment whether untrusted workloads can reach the TUN/vhost-net path. Not in CISA KEV and unlikely to be targeted opportunistically; prioritize as part of normal stable-kernel hygiene rather than emergency patching.
Exploit ScenarioDerived

A malicious or buggy guest on a KVM host using vhost-net with XDP saturates the tap with traffic while the host is at memory pressure; each build_skb() failure leaks one page-frag, and sustained batches gradually consume host memory until the OOM killer fires or networking degrades. No public exploit identified at time of analysis, and the attack requires already-tight host memory to drive build_skb() into failure reliably.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 14, 2026

Memory leak in the Linux kernel's TUN driver (tun_xdp_one) allows a local attacker to exhaust host memory by repeatedly triggering build_skb() allocation failures, leaking one page-frag chunk per failed batch entry. The flaw affects the vhost_net XDP fast-path used by virtual machines and containers; with no public exploit identified at time of analysis and an EPSS score of 0.02% (5th percentile), real-world weaponization risk is low, but sustained leakage on busy virtualization hosts could degrade availability.

RemediationAI

Vendor-released patch: upgrade to Linux 6.12.93, 6.18.35, 7.0.12 or 7.1-rc6 (or any distribution kernel that backports commits aa8963fdce66, aa308e9dbb9a, d16e38fac09a or 4fefc6156a16 from git.kernel.org/stable). If immediate kernel upgrade is not feasible, the practical compensating control is to avoid the vulnerable code path: disable XDP on tun/tap interfaces backing guest VMs (do not attach an XDP program to the host-side tap), or fall back from vhost-net to userspace virtio backends - both options reduce packet-processing throughput for affected guests and should be evaluated against workload performance budgets. On hosts where untrusted tenants cannot drive the vhost-net XDP path (no nested virtualization, no untrusted container with CAP_NET_ADMIN on a tap), exposure is already minimal and scheduled patching is sufficient.

Affected VersionsENISA

Linux patch: 0
Linux patch: 7.0.12
Linux patch: 7.1-rc6
Linux 043d222f93ab8c76b56a3b315cd8692e35affb6c <aa8963fdce667a42fb7f0bdd2909fadcab02f9a8
Linux patch: 6.18.35
Linux 043d222f93ab8c76b56a3b315cd8692e35affb6c <aa308e9dbb9acb17cacdbbce9e4504f69bac8385
Linux patch: 6.12.93
Linux 043d222f93ab8c76b56a3b315cd8692e35affb6c <d16e38fac09a47bfcf98c1ad65a1bb53f94540f5
Linux 043d222f93ab8c76b56a3b315cd8692e35affb6c <4fefc6156a162a9f50035c12091a5e5130c82c6e
Linux 4.20

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug lives in drivers/net/tun.c in the XDP transmit path. vhost_net_build_xdp() allocates a page-frag for each frame and hands it to tun_xdp_one(); when build_skb() returns NULL (typically under memory pressure), the function sets -ENOMEM and jumps to the 'out' label without calling put_page() on the already-allocated frag. tun_sendmsg() swallows the per-buffer error and reports total_len as success, so vhost_tx_batch() never reclaims the page either. The class of bug is a missing release on an error path (CWE-401 Missing Release of Memory After Effective Lifetime), affecting upstream Linux from approximately 4.20 (when the tun XDP batch path was introduced via commit 043d222f93ab) through the fix commits backported to 6.12.93, 6.18.35, 7.0.12 and 7.1-rc6.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
vuln.today AI 2.8 LOW

Local guest/CAP_NET_ADMIN access (PR:L, AV:L), build_skb() failure is non-trivial to force reliably (AC:H), guest-to-host scope change (S:C), gradual leak yields partial availability impact (A:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
SUSE 3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 14, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Jun 09, 2026 - 14:01 EUVD
CVE Published
Jun 09, 2026 - 12:11 cve.org
HIGH 7.1
CVE Published
Jun 09, 2026 - 12:11 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tun: free page on build_skb failure in tun_xdp_one()

When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk.

Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform.

Executive ViewAI

Why It Matters

A memory leak in the Linux kernel's TUN driver (CVE-2026-46322) affects virtualization and container infrastructure, creating potential for denial of service through memory exhaustion on busy hypervisor hosts. No public exploit identified at time of analysis and exploitation likelihood remains low (EPSS: 0.02%, 5th percentile), but the vulnerability impacts critical infrastructure and requires coordinated kernel patching across data center environments.

Business Impact: High
Compensating Controls

Apply vendor patch. Pending deployment: implement automated memory monitoring and alerting on hypervisor hosts to detect early signs of exhaustion; consider disabling XDP acceleration on vhost_net interfaces where operationally feasible.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
1
1 sources
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Memory and Network Vulnerabilities

View all 20
CVE-2026-46316 CRITICAL
9.3
CVE-2026-46327 HIGH
7.8
CVE-2026-46330 HIGH
7.8
CVE-2026-46325 CRITICAL
9.8
CVE-2026-46323 HIGH
7.8
CVE-2026-46320 HIGH
7.4
CVE-2026-46332 HIGH
8.0
CVE-2026-46321 HIGH
7.1
CVE-2026-46328 HIGH
7.3
CVE-2026-52907 HIGH
7.8
CVE-2026-46317 HIGH
8.8
CVE-2026-46318 MEDIUM
5.5
CVE-2026-46319 HIGH
7.8
CVE-2026-46324 HIGH
7.8
CVE-2026-46326 HIGH
8.4
CVE-2026-46329 MEDIUM
5.5
CVE-2026-52904 MEDIUM
5.5
CVE-2026-52905 MEDIUM
5.5
CVE-2026-52906 HIGH
7.7

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2020-6079 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Low
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46322 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/369522 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/2638a9c1521905bb5c5d1e95c8fbc09f79148ed7 REF https://git.kernel.org/stable/c/26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9 REF https://git.kernel.org/stable/c/4fefc6156a162a9f50035c12091a5e5130c82c6e REF https://git.kernel.org/stable/c/60d9c0d6cdde5420d6483c921b16fe5465eb5238 REF https://git.kernel.org/stable/c/793385c154771603b8671dd8338927221e9d8d78 REF https://git.kernel.org/stable/c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385 REF https://git.kernel.org/stable/c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8 REF https://git.kernel.org/stable/c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy