Executive brief
A memory leak vulnerability was identified in the Linux kernel's networking component responsible for VLAN tagging (802.1Q). The system fails to properly delete old priority settings when they are cleared, causing memory to slowly fill up over time if these settings are frequently changed. If left unaddressed, this could eventually lead to system instability or a crash due to memory exhaustion.
Technical details
A memory leak exists in net/8021q/vlan_dev.c within the vlan_dev_set_egress_priority() function. The implementation previously handled cleared egress priority mappings by retaining them as 'tombstones' in a hash table rather than unlinking them. Repeated set and clear cycles with distinct skb priorities lead to the accumulation of mapping nodes that are only freed upon device teardown. The fix involves properly unlinking the nodes from the RCU-protected egress mapping lists and freeing them using kfree_rcu() after a grace period. This vulnerability is primarily a local denial-of-service vector via memory exhaustion.
Affected products
- Linux Linux Kernel Introduced in 2.6.12-rc2; fixed in various stable branches including 7dddc74 and a52e122
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory