CVE-2026-46322: Linux Kernel TUN Driver Memory Leak in XDP Processing

Technical summary

CVE-2026-46322 is a resource exhaustion vulnerability in the Linux kernel's tun driver, specifically in the tun_xdp_one() function. When build_skb() fails during XDP frame processing, the function returns -ENOMEM without calling put_page() on the page allocated by vhost_net_build_xdp(). Because tun_sendmsg() masks per-buffer errors and returns total_len to indicate batch success, vhost_tx_batch() never detects the failure and thus never frees the leaked page. Unlike other error exits in tun_xdp_one() that correctly perform cleanup, this path bypasses page-frag deallocation, causing a page leak per build_skb() failure. The fix requires adding put_page() before the error return to match existing cleanup patterns.

Business impact

On systems running vulnerable Linux kernels with active TUN/vhost_net workloads (particularly virtual networking, container platforms, or VPN services), this vulnerability causes gradual memory resource exhaustion. Over time, repeated build_skb() failures deplete physical memory pages, potentially causing service degradation, application crashes due to memory pressure, or triggering the OOM killer. Systems under sustained load or handling high packet volume are most vulnerable. The impact is availability-focused: legitimate traffic may be starved of resources, and workload performance degrades as the kernel spends more time managing memory pressure.

Affected systems

The vulnerability affects Linux kernel versions that include the tun driver with XDP support. All six referenced vendor-product entries confirm Linux kernel across multiple versions. Systems running virtualization platforms (KVM/QEMU), container runtimes relying on vhost_net, or custom networking stacks using TUN+XDP are at risk. Verify your kernel version against vendor advisories and upstream kernel commit availability. Embedded systems, IoT devices, and specialized appliances using Linux kernels in networking roles should be assessed.

Exploitability

This is not a remote code execution or privilege escalation vector. Exploitation requires local context: the TUN device must be in active use with XDP programs, and the attacker must be able to trigger repeated build_skb() failures through malformed or unusual packet patterns. No special privileges are required to cause the leak—any process able to interact with a TUN device can potentially trigger the memory leak. The vulnerability is more of a denial-of-service risk than a direct security exploit, but it is nonetheless exploitable by a local or unprivileged user in shared or multi-tenant environments.

Remediation

Apply kernel patches that add the missing put_page() call in tun_xdp_one() before the error return path. Verify patch availability from your Linux distribution's security advisories or upstream kernel repositories. For immediate mitigation on systems where patching is delayed, restrict TUN device access to trusted processes and monitor memory usage for signs of page-frag exhaustion. Disabling XDP on TUN devices if not required also eliminates the vulnerable code path.

Patch guidance

Monitor your distribution's security update channels (Debian, Red Hat, Ubuntu, etc.) for kernel patches addressing CVE-2026-46322. Patches should explicitly add put_page() cleanup to the tun_xdp_one() error path. Verify against the upstream Linux kernel commit that fixes this issue. Test patches in non-production environments first, as kernel updates typically require reboot. Prioritize systems running high-traffic virtual networking or container workloads where the failure path is more likely to be triggered.

Detection guidance

Monitor kernel memory metrics, specifically page-frag allocation and reclamation. Tools like /proc/meminfo, slabtop, and memory profilers can show unusual page-cache growth tied to tun driver activity. Enable kernel logging (dmesg) to capture build_skb() failures or XDP processing errors. In virtual environments, track guest-to-host memory pressure patterns. Correlate memory degradation with TUN device packet rates and XDP rule changes. Network monitoring tools can track packet patterns that trigger build_skb() failures (malformed headers, unusual sizes) to identify active exploitation attempts.

Why prioritize this

Although not yet listed as actively exploited in the wild (KEV status: not added), this vulnerability scores 7.1 CVSS HIGH due to its local availability impact and ease of triggering in shared environments. Systems handling high-volume networking, virtualization clusters, or containerized workloads should patch promptly because accumulated memory leaks directly degrade service availability. It is a lower priority than remote code execution or authentication bypass vulnerabilities, but should not be deferred indefinitely on production systems with active TUN/XDP usage.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH severity) reflects: (1) local attack vector—exploitation requires local system access or control of a TUN-using process; (2) low complexity—no special race conditions or multi-step exploitation required; (3) no privileges needed; (4) scope change—memory exhaustion on one service can affect other system services competing for the same physical memory; (5) high availability impact—resource exhaustion degrades or stops service. Confidentiality and integrity are not affected (only availability is impacted), moderating the score from critical, but the practical impact on infrastructure availability is significant.

Frequently asked questions