CVE-2026-46321: Linux Kernel TUN Driver DoS Vulnerability

CVE-2026-46321 Overview

CVE-2026-46321 is a memory leak vulnerability in the Linux kernel's tun driver, specifically in the tun_xdp_one() function. The function returns -EINVAL when it encounters a frame shorter than ETH_HLEN, but fails to free the page that vhost_net_build_xdp() previously allocated. A local process with access to /dev/net/tun and /dev/vhost-net can submit crafted TX descriptors to leak page-frag chunks on each kick. A tight submission loop exhausts host memory and triggers an out-of-memory (OOM) panic, resulting in denial of service on the affected host.

Critical Impact
A local attacker with access to /dev/net/tun and /dev/vhost-net can exhaust host memory and trigger an OOM panic, denying service to all tenants on the affected Linux host.

Affected Products

Linux kernel versions containing the vulnerable tun_xdp_one() short-frame error path
Hosts exposing /dev/net/tun and /dev/vhost-net to unprivileged or semi-privileged processes
Virtualization hosts using vhost-net with tun/tap backends (including KVM/QEMU environments)

Discovery Timeline

2026-06-09 - CVE-2026-46321 published to the National Vulnerability Database (NVD)
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-46321

Vulnerability Analysis

The flaw resides in the tun_xdp_one() function within the Linux kernel tun driver. When vhost_net_build_xdp() prepares a frame for transmission, it allocates a page-frag chunk to hold the data. The receiving function tun_xdp_one() validates the frame length against ETH_HLEN (the minimum Ethernet header length). If validation fails, the function returns -EINVAL without releasing the previously allocated page.

The error is compounded by callers that discard the return code. tun_sendmsg() drops the -EINVAL and still returns total_len, so vhost_tx_batch() follows the success path and never frees the page. Each short frame in a batch leaks one page-frag chunk. This classifies as a memory leak [CWE-401] in a privileged kernel subsystem reachable from user space.

Root Cause

The root cause is missing cleanup on the short-frame rejection path inside tun_xdp_one(). The XDP-program error path in the same function correctly frees the page, but the ETH_HLEN length check does not. This inconsistency means valid error handling exists in one branch while the other leaks resources on every failed validation.

Attack Vector

A local process opens /dev/net/tun and /dev/vhost-net, attaches a tun/tap device as the vhost-net backend, and submits TX descriptors whose payload length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch. Sustained submission depletes kernel memory until the OOM killer fires or the host panics. The attack requires local access and the ability to interact with the vhost-net interface, which is typically restricted to virtualization-related users or containers granted those device nodes.

The upstream fix frees the page before returning -EINVAL, aligning the short-frame error path with the existing XDP-program error path in the same function. See the kernel commit for the corrected logic.

Detection Methods for CVE-2026-46321

Indicators of Compromise

Sustained, unexplained growth of kernel page-frag allocations on hosts running vhost-net
OOM killer events or kernel panic traces referencing tun_xdp_one, tun_sendmsg, or vhost_tx_batch
Processes repeatedly opening /dev/vhost-net and /dev/net/tun outside expected virtualization workflows
Unusual TX descriptor submission patterns from non-hypervisor user-space processes

Detection Strategies

Monitor /proc/meminfo and slab statistics for abnormal kernel memory consumption correlated with vhost-net activity
Audit open() syscalls against /dev/net/tun and /dev/vhost-net using auditd or eBPF tracing
Inspect kernel logs (dmesg) for OOM panics or warnings originating from the tun driver stack
Track per-process page-frag accounting to identify outliers driving kernel memory growth

Monitoring Recommendations

Alert on sudden kernel memory pressure on hypervisor hosts that lack a corresponding workload change
Baseline normal vhost-net ioctl frequency and flag processes that exceed it
Collect kernel crash dumps to confirm whether OOM events trace back to tun/vhost code paths

How to Mitigate CVE-2026-46321

Immediate Actions Required

Apply the upstream stable-tree patch that frees the page on the short-frame rejection path in tun_xdp_one()
Restrict access to /dev/net/tun and /dev/vhost-net to trusted virtualization users and service accounts only
Review container and VM tenant configurations to confirm these device nodes are not exposed unnecessarily
Enable kernel OOM and crash telemetry so memory exhaustion events trigger investigation

Patch Information

The fix is available in the upstream Linux stable tree. Refer to the following commits for the corrected error-handling path in tun_xdp_one():

Distribution-provided backports should be installed once available from the respective vendor channels.

Workarounds

Remove read/write permissions on /dev/net/tun and /dev/vhost-net for non-virtualization users until the patch is applied
Disable vhost-net acceleration where it is not required, forcing traffic through the standard tun/tap path
Use Linux namespaces and seccomp to block the affected ioctls for untrusted workloads

bash

# Configuration example: restrict vhost-net device access to a dedicated group
sudo groupadd -r vhostnet
sudo chown root:vhostnet /dev/vhost-net /dev/net/tun
sudo chmod 0660 /dev/vhost-net /dev/net/tun
# Add only trusted virtualization service accounts
sudo usermod -aG vhostnet qemu