Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-46321

In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk. A local process that can open /dev/net/tun and /de
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:39c569dd2e0724a1e6750c32191cd5e73996f53889286e5597f70b9436f6752e
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/tun.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0a6f46a9332ad6958992d64d3b3a81a80b2ca940","status":"affected","version":"6100e0237204890269e3f934acfc50d35fd6f319","versionType":"git"},{"lessThan":"0e8211fcf9426f5adddf32516ba0f400ceb9544d","status":"affected","version":"589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2","versionType":"git"},{"lessThan":"e915445942af6dcea628bf66d6241641201a0c41","status":"affected","version":"ad6b3f622ccfb4bfedfa53b6ebd9…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/tun.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrE…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/tun.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0a6f46a9332ad6958992d64d3b3a81a80b2ca940","status":"affected","version":"6100e0237204890269e3f934acfc50d35fd6f319","versionType":"git"},{"lessThan":"0e8211fcf9426f5adddf32516ba0f400ceb9544d","status":"affected","version":"589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2","versionType":"git"},{"lessThan":"e915445942af6dcea628bf66d6241641201a0c41","status":"affected","version":"ad6b3f622ccfb4bfedfa53b6ebd9…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/tun.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrE…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/0a6f46a9332ad6958992d64d3b3a81a80b2ca940"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/0e8211fcf9426f5adddf32516ba0f400ceb9544d"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/37a1c268c2c8090bf4dc552d732bd23ba36f8eb0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/5b34f9e4fe2f203724a6e893d6df0316b9670057"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/69863ff2720a0e9871f1a5710f2a33a94217fee0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/98c67be9eb9de72465a071949e84a3cdb8fab5a3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/e915445942af6dcea628bf66d6241641201a0c41"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a5f01d0cb5d8530744e9cc60879d076de114edb22ebc251442817c63367e46c1 · sha256:0cd4602f0c52279c… · /containers/cna/references/7

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer