Executive brief
A memory leak vulnerability was identified in the Linux kernel's TUN/TAP driver, which is used to create virtual network interfaces. When the system fails to create a network buffer under high memory pressure, it fails to release the memory previously allocated for that task. Over time, this could lead to a gradual depletion of system memory, potentially impacting the performance or stability of the host operating system.
Technical details
A memory leak exists in drivers/net/tun.c within the tun_xdp_one() function. When build_skb() fails to allocate a socket buffer (skb), the function returns an -ENOMEM error without calling put_page() on the page allocated by vhost_net_build_xdp(). Because tun_sendmsg() ignores per-buffer errors in this path and returns a success length to vhost_tx_batch(), the allocated memory is never reclaimed. This vulnerability can be triggered during XDP (Express Data Path) processing under memory pressure. Patches have been merged into multiple stable kernel branches to ensure put_page() is called on the error path.
Affected products
- Linux Linux Kernel Fixed in 4fefc61, aa308e9, aa8963f, d16e38f
Timeline
- 2026-05-21: other: Patch submitted by developer
- 2026-06-09: disclosed: Vulnerability published in NVD