Количество 13
Количество 13
CVE-2026-46320
In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().
CVE-2026-46320
In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().
CVE-2026-46320
In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().
CVE-2026-46320
tap: free page on error paths in tap_get_user_xdp()
CVE-2026-46320
In the Linux kernel, the following vulnerability has been resolved: t ...
GHSA-xqcf-gwj9-5c88
In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().
SUSE-SU-2026:3044-1
Security update for the Linux Kernel
SUSE-SU-2026:3089-1
Security update for the Linux Kernel
SUSE-SU-2026:3156-1
Security update for the Linux Kernel
SUSE-SU-2026:2914-1
Security update for the Linux Kernel
SUSE-SU-2026:2800-1
Security update for the Linux Kernel
SUSE-SU-2026:2799-1
Security update for the Linux Kernel
openSUSE-SU-2026:21388-1
Security update for the Linux Kernel
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-46320 In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one(). | CVSS3: 7.4 | 0% Низкий | около 2 месяцев назад |
 | CVE-2026-46320 In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one(). | CVSS3: 5.5 | 0% Низкий | около 2 месяцев назад |
 | CVE-2026-46320 In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one(). | CVSS3: 7.4 | 0% Низкий | около 2 месяцев назад |
 | CVE-2026-46320 tap: free page on error paths in tap_get_user_xdp() | CVSS3: 7.1 | 0% Низкий | около 1 месяца назад |
| CVE-2026-46320 In the Linux kernel, the following vulnerability has been resolved: t ... | CVSS3: 7.4 | 0% Низкий | около 2 месяцев назад |
| GHSA-xqcf-gwj9-5c88 In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one(). | CVSS3: 7.4 | 0% Низкий | около 2 месяцев назад |
 | SUSE-SU-2026:3044-1 Security update for the Linux Kernel | 21 день назад | ||
| SUSE-SU-2026:3089-1 Security update for the Linux Kernel | 19 дней назад | ||
| SUSE-SU-2026:3156-1 Security update for the Linux Kernel | 15 дней назад | ||
| SUSE-SU-2026:2914-1 Security update for the Linux Kernel | 23 дня назад | ||
| SUSE-SU-2026:2800-1 Security update for the Linux Kernel | 28 дней назад | ||
| SUSE-SU-2026:2799-1 Security update for the Linux Kernel | 28 дней назад | ||
| openSUSE-SU-2026:21388-1 Security update for the Linux Kernel | 15 дней назад |
Уязвимостей на страницу