CVE-2026-46321

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46321", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.112Z", "datePublished": "2026-06-09T12:11:13.872Z", "dateUpdated": "2026-10-15T01:21:35.519Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:16.239Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on short-frame rejection in tun_xdp_one()\n\ntun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without\nfreeing the page that vhost_net_build_xdp() allocated for it.\ntun_sendmsg() discards that -EINVAL and still returns total_len, so\nvhost_tx_batch() takes the success path and never frees the page; each\nshort frame in a batch leaks one page-frag chunk.\n\nA local process that can open /dev/net/tun and /dev/vhost-net can hit\nthis path: it attaches a tun/tap device as the vhost-net backend and\nfeeds TX descriptors whose length minus the virtio-net header is below\nETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a\ntight submission loop exhausts host memory and triggers an OOM panic.\nFree the page before returning -EINVAL, matching the XDP-program error\npath in the same function."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached via local host interfaces (/dev/net/tun and /dev/vhost-net ioctls/sendmsg) or from a KVM guest through virtio-net TX descriptors processed by vhost-net, not via remote network packets to the host stack.\nAC:L - An attacker reliably triggers the leak by repeatedly submitting TX frames whose length minus the virtio-net header is below ETH_HLEN; no races or attacker-uncontrollable layout conditions are required.\nPR:N - A malicious KVM guest on a host using vhost-net with a tun/tap backend needs no host privileges\u2014only the ability to craft short virtio-net TX descriptors\u2014while a direct host attacker can also obtain CAP_NET_ADMIN via unprivileged user namespaces.\nUI:N - Exploitation requires no victim interaction beyond normal VM or namespace operation; the attacker drives the vhost TX path directly in a tight loop.\nS:C - In the highest-impact cloud/KVM deployment, an unprivileged guest VM crosses the hypervisor security boundary to exhaust host kernel memory and panic the host, affecting resources outside the guest's security scope.\nC:N - The bug is a page-fragment memory leak with no out-of-bounds access, use-after-free, or information disclosure; freed pages are simply never returned to the allocator.\nI:N - No kernel memory corruption or data modification occurs; the only effect is unbounded consumption of page-frags leading to denial of service.\nA:H - Sustained submission of short batched frames leaks one page-frag per frame, exhausts host memory, and can trigger an OOM kernel panic as described in the fix commit."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/tun.c"], "versions": [{"version": "6100e0237204890269e3f934acfc50d35fd6f319", "lessThan": "0a6f46a9332ad6958992d64d3b3a81a80b2ca940", "status": "affected", "versionType": "git"}, {"version": "589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2", "lessThan": "0e8211fcf9426f5adddf32516ba0f400ceb9544d", "status": "affected", "versionType": "git"}, {"version": "ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146", "lessThan": "e915445942af6dcea628bf66d6241641201a0c41", "status": "affected", "versionType": "git"}, {"version": "d5ad89b7d01ed4e66fd04734fc63d6e78536692a", "lessThan": "5b34f9e4fe2f203724a6e893d6df0316b9670057", "status": "affected", "versionType": "git"}, {"version": "049584807f1d797fc3078b68035450a9769eb5c3", "lessThan": "69863ff2720a0e9871f1a5710f2a33a94217fee0", "status": "affected", "versionType": "git"}, {"version": "049584807f1d797fc3078b68035450a9769eb5c3", "lessThan": "37a1c268c2c8090bf4dc552d732bd23ba36f8eb0", "status": "affected", "versionType": "git"}, {"version": "049584807f1d797fc3078b68035450a9769eb5c3", "lessThan": "98c67be9eb9de72465a071949e84a3cdb8fab5a3", "status": "affected", "versionType": "git"}, {"version": "049584807f1d797fc3078b68035450a9769eb5c3", "lessThan": "f4feb1e20058e407cb00f45aff47f5b7e19a6bbf", "status": "affected", "versionType": "git"}, {"version": "32b0aaba5dbc85816898167d9b5d45a22eae82e9", "status": "affected", "versionType": "git"}, {"version": "a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb", "status": "affected", "versionType": "git"}, {"version": "8418f55302fa1d2eeb73e16e345167e545c598a5", "status": "affected", "versionType": "git"}, {"version": "5.10.223", "lessThan": "5.10.259", "status": "affected", "versionType": "semver"}, {"version": "5.15.164", "lessThan": "5.15.210", "status": "affected", "versionType": "semver"}, {"version": "6.1.102", "lessThan": "6.1.176", "status": "affected", "versionType": "semver"}, {"version": "6.6.43", "lessThan": "6.6.143", "status": "affected", "versionType": "semver"}, {"version": "5.4.281", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "6.9.12", "lessThan": "6.10", "status": "affected", "versionType": "semver"}, {"version": "6.10.2", "lessThan": "6.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/tun.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.223", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.164", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.102", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.43", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.281"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0a6f46a9332ad6958992d64d3b3a81a80b2ca940"}, {"url": "https://git.kernel.org/stable/c/0e8211fcf9426f5adddf32516ba0f400ceb9544d"}, {"url": "https://git.kernel.org/stable/c/e915445942af6dcea628bf66d6241641201a0c41"}, {"url": "https://git.kernel.org/stable/c/5b34f9e4fe2f203724a6e893d6df0316b9670057"}, {"url": "https://git.kernel.org/stable/c/69863ff2720a0e9871f1a5710f2a33a94217fee0"}, {"url": "https://git.kernel.org/stable/c/37a1c268c2c8090bf4dc552d732bd23ba36f8eb0"}, {"url": "https://git.kernel.org/stable/c/98c67be9eb9de72465a071949e84a3cdb8fab5a3"}, {"url": "https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf"}], "title": "tun: free page on short-frame rejection in tun_xdp_one()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:21:35.519Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/tun.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0a6f46a9332ad6958992d64d3b3a81a80b2ca940", "status": "affected", "version": "6100e0237204890269e3f934acfc50d35fd6f319", "versionType": "git"}, {"lessThan": "0e8211fcf9426f5adddf32516ba0f400ceb9544d", "status": "affected", "version": "589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2", "versionType": "git"}, {"lessThan": "e915445942af6dcea628bf66d6241641201a0c41", "status": "affected", "version": "ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146", "versionType": "git"}, {"lessThan": "5b34f9e4fe2f203724a6e893d6df0316b9670057", "status": "affected", "version": "d5ad89b7d01ed4e66fd04734fc63d6e78536692a", "versionType": "git"}, {"lessThan": "69863ff2720a0e9871f1a5710f2a33a94217fee0", "status": "affected", "version": "049584807f1d797fc3078b68035450a9769eb5c3", "versionType": "git"}, {"lessThan": "37a1c268c2c8090bf4dc552d732bd23ba36f8eb0", "status": "affected", "version": "049584807f1d797fc3078b68035450a9769eb5c3", "versionType": "git"}, {"lessThan": "98c67be9eb9de72465a071949e84a3cdb8fab5a3", "status": "affected", "version": "049584807f1d797fc3078b68035450a9769eb5c3", "versionType": "git"}, {"lessThan": "f4feb1e20058e407cb00f45aff47f5b7e19a6bbf", "status": "affected", "version": "049584807f1d797fc3078b68035450a9769eb5c3", "versionType": "git"}, {"status": "affected", "version": "32b0aaba5dbc85816898167d9b5d45a22eae82e9", "versionType": "git"}, {"status": "affected", "version": "a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb", "versionType": "git"}, {"status": "affected", "version": "8418f55302fa1d2eeb73e16e345167e545c598a5", "versionType": "git"}, {"lessThan": "5.10.259", "status": "affected", "version": "5.10.223", "versionType": "semver"}, {"lessThan": "5.15.210", "status": "affected", "version": "5.15.164", "versionType": "semver"}, {"lessThan": "6.1.176", "status": "affected", "version": "6.1.102", "versionType": "semver"}, {"lessThan": "6.6.143", "status": "affected", "version": "6.6.43", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.281", "versionType": "semver"}, {"lessThan": "6.10", "status": "affected", "version": "6.9.12", "versionType": "semver"}, {"lessThan": "6.11", "status": "affected", "version": "6.10.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/tun.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9247B8C6-D97A-4CCC-B960-AFD2F536EFC1", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.281", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8D8E517-E90E-4A05-B563-DF7F717264E2", "versionEndExcluding": "5.10.259", "versionStartIncluding": "5.10.223", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C7A70B4-6094-4392-99CE-5713E2A31596", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.15.164", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "650D4114-2C4E-4BF7-8AB9-4CC4104FEC16", "versionEndExcluding": "6.1.176", "versionStartIncluding": "6.1.102", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AF81631-4260-4438-AE5B-61C04CA0BAA0", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.6.43", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FA62583-78C1-42CE-900B-6D2B268EAED2", "versionEndExcluding": "6.10", "versionStartIncluding": "6.9.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DAD5D9AB-C0E6-44DF-8475-306495552E60", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.10.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on short-frame rejection in tun_xdp_one()\n\ntun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without\nfreeing the page that vhost_net_build_xdp() allocated for it.\ntun_sendmsg() discards that -EINVAL and still returns total_len, so\nvhost_tx_batch() takes the success path and never frees the page; each\nshort frame in a batch leaks one page-frag chunk.\n\nA local process that can open /dev/net/tun and /dev/vhost-net can hit\nthis path: it attaches a tun/tap device as the vhost-net backend and\nfeeds TX descriptors whose length minus the virtio-net header is below\nETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a\ntight submission loop exhausts host memory and triggers an OOM panic.\nFree the page before returning -EINVAL, matching the XDP-program error\npath in the same function."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntun: liberar p\u00e1gina en el rechazo de tramas cortas en tun_xdp_one()\n\ntun_xdp_one() devuelve -EINVAL en una trama m\u00e1s corta que ETH_HLEN sin liberar la p\u00e1gina que vhost_net_build_xdp() asign\u00f3 para ella. tun_sendmsg() descarta ese -EINVAL y a\u00fan devuelve total_len, por lo que vhost_tx_batch() toma la ruta de \u00e9xito y nunca libera la p\u00e1gina; cada trama corta en un lote filtra un chunk de fragmento de p\u00e1gina.\n\nUn proceso local que puede abrir /dev/net/tun y /dev/vhost-net puede alcanzar esta ruta: adjunta un dispositivo tun/tap como el backend de vhost-net y alimenta descriptores TX cuya longitud menos el encabezado virtio-net est\u00e1 por debajo de ETH_HLEN. Cada kick filtra los chunks de fragmentos de p\u00e1gina para ese lote, y un bucle de env\u00edo ajustado agota la memoria del host y desencadena un p\u00e1nico OOM. Liberar la p\u00e1gina antes de devolver -EINVAL, coincidiendo con la ruta de error del programa XDP en la misma funci\u00f3n."}], "id": "CVE-2026-46321", "lastModified": "2026-10-15T02:19:53.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-09T13:16:37.473", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a6f46a9332ad6958992d64d3b3a81a80b2ca940"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e8211fcf9426f5adddf32516ba0f400ceb9544d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/37a1c268c2c8090bf4dc552d732bd23ba36f8eb0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5b34f9e4fe2f203724a6e893d6df0316b9670057"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69863ff2720a0e9871f1a5710f2a33a94217fee0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98c67be9eb9de72465a071949e84a3cdb8fab5a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e915445942af6dcea628bf66d6241641201a0c41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: tun: free page on short-frame rejection in tun_xdp_one()", "id": "2486977", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486977"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-763", "details": ["A flaw was found in the Linux kernel. A local attacker with access to the tun/tap device can exploit this vulnerability. By sending network frames shorter than the expected header length, the system fails to free allocated memory pages, leading to memory leaks. This can exhaust system memory, resulting in a denial of service (DoS) and causing the system to crash."], "name": "CVE-2026-46321", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46321\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46321\nhttps://lore.kernel.org/linux-cve-announce/2026060925-CVE-2026-46321-8e46@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[049584807f1d797fc3078b68035450a9769eb5c3,69863ff2720a0e9871f1a5710f2a33a94217fee0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[049584807f1d797fc3078b68035450a9769eb5c3,37a1c268c2c8090bf4dc552d732bd23ba36f8eb0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[049584807f1d797fc3078b68035450a9769eb5c3,98c67be9eb9de72465a071949e84a3cdb8fab5a3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[049584807f1d797fc3078b68035450a9769eb5c3,f4feb1e20058e407cb00f45aff47f5b7e19a6bbf]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "32b0aaba5dbc85816898167d9b5d45a22eae82e9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "6100e0237204890269e3f934acfc50d35fd6f319"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "d5ad89b7d01ed4e66fd04734fc63d6e78536692a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8418f55302fa1d2eeb73e16e345167e545c598a5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.281,5.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.223,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.164,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.102,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.43,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.9.12,6.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.10.2,6.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-09T13:30:04.958694+00:00", "updated": "2026-08-13T20:30:02.623943+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}