CVE-2026-46153 Overview
CVE-2026-46153 is a memory leak vulnerability in the Linux kernel's 802.1Q VLAN subsystem. The flaw resides in the vlan_dev_set_egress_priority() function, which manages egress Quality of Service (QoS) priority mappings for VLAN devices. The function retains cleared egress priority mappings in the hash table as tombstones rather than removing them. Repeated set and clear cycles using distinct skb priorities cause mapping nodes to accumulate until device teardown, leaking kernel memory over time. The Linux kernel maintainers have resolved the issue by deleting mappings when vlan_prio is cleared and unlinking nodes safely under Read-Copy-Update (RCU) protection.
Critical Impact
Long-running systems performing repeated VLAN egress priority reconfiguration can exhaust kernel memory, leading to degraded performance or denial of service conditions.
Affected Products
- Linux kernel (upstream) versions containing the 8021q VLAN egress priority mapping logic prior to the referenced fix commits
- Distributions shipping affected stable kernel branches
- Systems leveraging VLAN egress QoS mapping via vlan_dev_set_egress_priority()
Discovery Timeline
- 2026-05-28 - CVE-2026-46153 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46153
Vulnerability Analysis
The vulnerability is a kernel memory leak in the 802.1Q VLAN driver path responsible for translating socket buffer (skb) priorities to egress 802.1p priority codes. The function vlan_dev_set_egress_priority() stores mapping entries inside a hash table keyed by skb priority. When a mapping is cleared by setting its vlan_prio value to zero, the existing implementation leaves the node in place as a tombstone marker instead of removing it from the hash chain.
Each subsequent set operation with a previously unused skb priority allocates a new node. Repeated set and clear cycles therefore grow the hash list monotonically. Memory consumed by these stale nodes is reclaimed only when the VLAN device is torn down. On long-lived systems with dynamic QoS reconfiguration, this behavior steadily depletes kernel slab memory.
Root Cause
The root cause is improper resource management in the egress priority mapping logic [CWE-401 class: Missing Release of Memory]. The original code path treats a cleared priority as a logical deletion but does not unlink and free the underlying node. The fix removes the mapping entry from the list when vlan_prio becomes zero. Because the egress mapping lists are now RCU protected, the node can be unlinked safely and freed after an RCU grace period, avoiding use-after-free risks on concurrent readers.
Attack Vector
The attack vector is local. A user with sufficient privileges to configure VLAN interfaces, typically CAP_NET_ADMIN, can repeatedly invoke set and clear operations on egress priority mappings using distinct skb priorities. Each iteration appends a new mapping node. Sustained reconfiguration exhausts kernel memory, causing slowdowns or denial of service on the host.
No verified exploit code is available. Refer to the upstream patches at git.kernel.org commit 7dddc74a and git.kernel.org commit a52e122c for the corrected implementation.
Detection Methods for CVE-2026-46153
Indicators of Compromise
- Steadily increasing kernel slab memory attributable to VLAN-related allocations on hosts with active QoS reconfiguration
- Growing entries in /proc/net/vlan/<iface> egress mapping output across reconfiguration cycles
- Repeated invocations of ip link set ... type vlan egress-qos-map or equivalent netlink calls from automation or operator scripts
Detection Strategies
- Monitor kernel memory metrics via /proc/meminfo and /proc/slabinfo for unexplained growth in slab caches associated with VLAN structures
- Audit netlink configuration traffic for repeated VLAN egress QoS map changes on the same interface
- Compare running kernel versions against vendor advisories that reference the upstream commits to confirm patch status
Monitoring Recommendations
- Track MemAvailable and slab usage trends over multi-day windows on systems running long-lived VLAN configurations
- Alert on processes repeatedly issuing RTM_NEWLINK netlink messages targeting VLAN egress QoS attributes
- Centralize kernel telemetry, including dmesg and resource counters, in a security data platform for retrospective analysis
How to Mitigate CVE-2026-46153
Immediate Actions Required
- Identify all hosts running affected Linux kernel versions, prioritizing systems that perform dynamic VLAN QoS reconfiguration
- Apply the upstream stable kernel update that includes the fix referenced by commits 7dddc74a and a52e122c
- Restrict CAP_NET_ADMIN to trusted administrative accounts and automation only
Patch Information
The upstream resolution removes cleared egress priority mappings from the hash and frees the underlying nodes after an RCU grace period. The fix is available in the stable kernel commit 7dddc74a and the stable kernel commit a52e122c. Apply the distribution kernel update that backports these commits to your stable branch.
Workarounds
- Avoid scripted set and clear cycles on VLAN egress QoS mappings until patched kernels are deployed
- Recreate the VLAN interface periodically to release accumulated mapping nodes if reconfiguration cannot be paused
- Limit which users and services can modify VLAN attributes by tightening capability assignments and namespace access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
