High 7.1Published Jun 9, 2026

CVE-2026-46322tun: free page on build_skb failure in tun_xdp_one()

Updated under an hour ago (Oct 27, 2026, 8:23 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weakness (CWE): CWE-401
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	043d222f93ab8c76b56a3b315cd8692e35affb6c builds before 26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9; from 043d222f93ab8c76b56a3b315cd8692e35affb6c before 793385c154771603b8671dd8338927221e9d8d78; from 043d222f93ab8c76b56a3b315cd8692e35affb6c before 2638a9c1521905bb5c5d1e95c8fbc09f79148ed7; from 043d222f93ab8c76b56a3b315cd8692e35affb6c before 60d9c0d6cdde5420d6483c921b16fe5465eb5238; from 043d222f93ab8c76b56a3b315cd8692e35affb6c before d16e38fac09a47bfcf98c1ad65a1bb53f94540f5; from 043d222f93ab8c76b56a3b315cd8692e35affb6c before aa308e9dbb9acb17cacdbbce9e4504f69bac8385; 043d222f93ab8c76b56a3b315cd8692e35affb6c builds before 4fefc6156a162a9f50035c12091a5e5130c82c6e; from 043d222f93ab8c76b56a3b315cd8692e35affb6c before aa8963fdce667a42fb7f0bdd2909fadcab02f9a8	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.20 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.93; from 6.13 before 6.18.35; from 6.19 before 7.0.12; 7.1; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9	patch
https://git.kernel.org/stable/c/793385c154771603b8671dd8338927221e9d8d78	patch
https://git.kernel.org/stable/c/2638a9c1521905bb5c5d1e95c8fbc09f79148ed7	patch
https://git.kernel.org/stable/c/60d9c0d6cdde5420d6483c921b16fe5465eb5238	patch
https://git.kernel.org/stable/c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5	patch
https://git.kernel.org/stable/c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385	patch
https://git.kernel.org/stable/c/4fefc6156a162a9f50035c12091a5e5130c82c6e	patch
https://git.kernel.org/stable/c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.