7.4

CVE-2026-46320: linux

CVSS: 7.4v3.1HighModified
AliasesUBUNTU-CVE-2026-46320DEBIAN-CVE-2026-46320CGA-3f4v-8g6f-2h3h
Published 09-06-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-46320 is a high (CVSS 7.4) vulnerability in linux. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.8% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.4/10
010
High · v3.1 (CVE.org)
EPSS score
0.25%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 42 · Related 43
OPENSUSE-SU-2026:11014-1OPENSUSE-SU-2026:21388-1SUSE-SU-2026:22521-1SUSE-SU-2026:22522-1SUSE-SU-2026:22665-1SUSE-SU-2026:22666-1

Timeline

  1. 09-06-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

16%

Versus all other CVEs

30-day change

+0.02 pp

From 0.24% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu163 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-146.146 | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1066.69 | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Chainguard6 products
  • linux-azure-6.18< 6.18.38-r0
  • linux-gcp-6.18< 6.18.38-r0
  • linux-gcp-6.18-bootc-boot-installed< 6.18.38-r0
  • linux-qemu-6.18< 6.18.38-r0
  • linux-qemu-6.18-bootc-boot-installed< 6.18.38-r0
Linux2 products
  • linux≥ 0efac27791ee068075d80f07c55a229b1335ce12, < 8d03e65eb6cfbffec471a6b65416f93679bf3286 | ≥ 0efac27791ee068075d80f07c55a229b1335ce12, < f979971835dddbca86cf99e3b2e2b94a408a1ab2 | ≥ 0efac27791ee068075d80f07c55a229b1335ce12, < 3f52a86a482a69294c50a5a2a097bd6f4104990a | ≥ 0efac27791ee068075d80f07c55a229b1335ce12, < d30aac0fa00ca0afc3e08174cf7f974a66bdcf05 | ≥ 0efac27791ee068075d80f07c55a229b1335ce12, < d68eab61944a9b0826fa2e954e42db1aa3201b7a | ≥ 0efac27791ee068075d80f07c55a229b1335ce12, < e27c17346628cb56843a83f93ac63c314c00f388 | ≥ 0efac27791ee068075d80f07c55a229b1335ce12, < 18a84c35842e19cd3c5534d8cee73d31863f696d | ≥ 0efac27791ee068075d80f07c55a229b1335ce12, < 3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2 | 4.20
  • linux_kernel≥ 4.20, < 5.10.259 | ≥ 5.11, < 5.15.210 | ≥ 5.16, < 6.1.176 | ≥ 6.2, < 6.6.143 | ≥ 6.7, < 6.12.94 | ≥ 6.13, < 6.18.36 | ≥ 6.19, < 7.0.12 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5
Debian1 product
  • linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.12-1

4 vendors · 172 products

References

40 links
Show all 40 references