Executive brief
A memory leak vulnerability was identified in the Linux kernel's network tap driver, which is used to manage virtual network interfaces. When the system receives certain types of malformed or short network packets, it fails to properly release memory, potentially leading to a gradual depletion of system resources. This could eventually impact the stability and performance of servers or virtualized environments.
Technical details
A memory leak exists in the tap_get_user_xdp() function within drivers/net/tap.c of the Linux kernel. The function fails to call put_page() when rejecting frames shorter than ETH_HLEN or when build_skb() fails. Because tap_sendmsg() ignores these specific error returns and returns 0, the calling vhost_tx_batch() assumes success and does not free the allocated page-frag chunks. This results in a kernel memory leak that can be triggered by network traffic. The issue has been resolved by ensuring pages are freed on all error paths before the skb is built.
Affected products
- Linux Linux Kernel All versions prior to the fix in tap_get_user_xdp
Timeline
- 2026-05-21: other: Patch submitted by developer
- 2026-06-09: advisory: CVE published by NVD
- 2026-06-09: patched: Fix committed to stable kernel tree