PT-2026-47757 · Linux · Linux
Published
2026-06-09
·
Updated
2026-06-09
·
CVE-2026-46320
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
tap: free page on error paths in tap get user xdp()
tap get user xdp() rejects a frame shorter than ETH HLEN with -EINVAL,
and returns -ENOMEM when build skb() fails. Both paths jump to the err
label without freeing the page that vhost net build xdp() allocated for
the frame. tap sendmsg() discards the per-buffer return value and always
returns 0, so vhost tx batch() takes the success path and never frees
the page; each rejected frame in a batch leaks one page-frag chunk.
Free the page on both error paths, before the skb is built. This is the
tap counterpart of the same leak in tun xdp one().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux