tun: free page on build_skb failure in tun_xdp_one()_CVE-2026-46322

{
    "lastseen": "",
    "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on build_skb failure in tun_xdp_one()\n\nWhen build_skb() fails in tun_xdp_one(), the function sets ret to\n-ENOMEM and jumps to the out label, which returns without freeing the\npage that vhost_net_build_xdp() allocated for the frame. As with the\nshort-frame rejection path, tun_sendmsg() discards the per-buffer error\nand still returns total_len, so vhost_tx_batch() takes the success path\nand never frees the page. Each build_skb() failure in a batch leaks one\npage-frag chunk.\n\nFree the page before taking the error path, matching the put_page() the\nother error exits of tun_xdp_one() already perform.",
    "published": "2026-06-09T12:11:14.776Z",
    "modified": "2026-06-14T04:30:17.312Z",
    "type": "cve",
    "title": "tun: free page on build_skb failure in tun_xdp_one()",
    "source": "Linux",
    "references": "https://git.kernel.org/stable/c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5\nhttps://git.kernel.org/stable/c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385\nhttps://git.kernel.org/stable/c/4fefc6156a162a9f50035c12091a5e5130c82c6e\nhttps://git.kernel.org/stable/c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8",
    "id": "CVE-2026-46322",
    "bulletinFamily": "",
    "cwe": null,
    "cvelist": null,
    "sourceData": "Linux Linux 043d222f93ab8c76b56a3b315cd8692e35affb6c\nLinux Linux 043d222f93ab8c76b56a3b315cd8692e35affb6c\nLinux Linux 043d222f93ab8c76b56a3b315cd8692e35affb6c\nLinux Linux 043d222f93ab8c76b56a3b315cd8692e35affb6c\nLinux Linux 4.20",
    "sourceHref": "",
    "cvss": {
        "score": 7.1,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Linux",
    "version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
    "vendor": "Linux",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}