CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one()

Synopsis

A memory leak (page-fragment leak on short-frame rejection) exists in the Linux kernel's tun/vhost-net subsystem. The flaw is reachable locally by any process that can open /dev/net/tun and /dev/vhost-net without requiring authentication, and no victim interaction is needed. Successful exploitation allows an unprivileged local process to exhaust host memory and trigger an out-of-memory panic, causing a full denial of service. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationNot required

  No credentials are needed; any local process with access to /dev/net/tun and /dev/vhost-net can trigger the leak.

• Victim interactionNot required

  The exploit runs entirely within the attacker's own process and requires no action from another user or service.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and condition-free, requiring only a tight descriptor submission loop to exhaust memory.

Blast Radius

• The attacker continuously leaks page-fragment chunks from the host kernel memory allocator with each batch of short TX descriptors submitted.
• Sustained submission exhausts available host memory, forcing the kernel's out-of-memory killer to fire and ultimately causing an OOM panic.
• The OOM panic brings down the host system or container runtime, taking all co-located workloads and services offline.