Executive brief
A vulnerability in the Linux kernel's network tunneling driver could allow a local user to crash the system. By sending specially crafted network traffic, an attacker can cause the system to run out of memory. This results in a denial-of-service condition where the server becomes unresponsive or reboots.
Technical details
A memory leak exists in the tun_xdp_one() function within the Linux kernel's TUN driver. When a frame shorter than the Ethernet header length (ETH_HLEN) is processed, the function returns an error without freeing the memory page previously allocated by vhost_net_build_xdp(). Because tun_sendmsg() ignores this error and reports success, the calling batch process fails to reclaim the memory. A local attacker with access to /dev/net/tun and /dev/vhost-net can exploit this by repeatedly sending short frames, exhausting host memory and triggering an OOM panic. Patches have been released to ensure the page is freed before the error return.
Affected products
- Linux Linux kernel
Timeline
- 2026-05-20: disclosed: Patch submitted by developer
- 2026-06-09: advisory: CVE published and patches merged into stable trees