CVE-2026-46320

tap: free page on error paths in tap_get_user_xdp()

State: Published
Severity: 7.4 High
Published: Jun 9, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tap: free page on error paths in tap_get_user_xdp()

tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk.

Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	Linux

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	0efac27791ee068075d80f07c55a229b1335ce12 to before 8d03e65eb6cfbffec471a6b65416f93679bf3286Affected 0efac27791ee068075d80f07c55a229b1335ce12 to before f979971835dddbca86cf99e3b2e2b94a408a1ab2Affected 0efac27791ee068075d80f07c55a229b1335ce12 to before 3f52a86a482a69294c50a5a2a097bd6f4104990aAffected 0efac27791ee068075d80f07c55a229b1335ce12 to before d30aac0fa00ca0afc3e08174cf7f974a66bdcf05Affected 0efac27791ee068075d80f07c55a229b1335ce12 to before d68eab61944a9b0826fa2e954e42db1aa3201b7aAffected 0efac27791ee068075d80f07c55a229b1335ce12 to before e27c17346628cb56843a83f93ac63c314c00f388Affected 0efac27791ee068075d80f07c55a229b1335ce12 to before 18a84c35842e19cd3c5534d8cee73d31863f696dAffected 0efac27791ee068075d80f07c55a229b1335ce12 to before 3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2Affected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

0efac27791ee068075d80f07c55a229b1335ce12 to before 8d03e65eb6cfbffec471a6b65416f93679bf3286Affected
0efac27791ee068075d80f07c55a229b1335ce12 to before f979971835dddbca86cf99e3b2e2b94a408a1ab2Affected
0efac27791ee068075d80f07c55a229b1335ce12 to before 3f52a86a482a69294c50a5a2a097bd6f4104990aAffected
0efac27791ee068075d80f07c55a229b1335ce12 to before d30aac0fa00ca0afc3e08174cf7f974a66bdcf05Affected
0efac27791ee068075d80f07c55a229b1335ce12 to before d68eab61944a9b0826fa2e954e42db1aa3201b7aAffected
0efac27791ee068075d80f07c55a229b1335ce12 to before e27c17346628cb56843a83f93ac63c314c00f388Affected
0efac27791ee068075d80f07c55a229b1335ce12 to before 18a84c35842e19cd3c5534d8cee73d31863f696dAffected
0efac27791ee068075d80f07c55a229b1335ce12 to before 3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2Affected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.