AZL-89690
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-89690.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-89690
- Upstream
- Published
- 2026-06-09T13:16:37Z
- Modified
- 2026-08-28T17:47:35Z
- Summary
- CVE-2026-46320 affecting package kernel for versions less than 6.6.143.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
tap: free page on error paths in tap_get_user_xdp()
tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk.
Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().
- References