338 lines
17 KiB
JSON
338 lines
17 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-46320",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2026-05-13T15:03:33.112Z",
|
||
"datePublished": "2026-06-09T12:11:12.882Z",
|
||
"dateUpdated": "2026-10-19T19:36:58.167Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T12:31:15.165Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntap: free page on error paths in tap_get_user_xdp()\n\ntap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL,\nand returns -ENOMEM when build_skb() fails. Both paths jump to the err\nlabel without freeing the page that vhost_net_build_xdp() allocated for\nthe frame. tap_sendmsg() discards the per-buffer return value and always\nreturns 0, so vhost_tx_batch() takes the success path and never frees\nthe page; each rejected frame in a batch leaks one page-frag chunk.\n\nFree the page on both error paths, before the skb is built. This is the\ntap counterpart of the same leak in tun_xdp_one()."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
|
||
"baseScore": 7.4,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:A - The bug is reached when guest-originated TX data crosses the virtio/vhost-net/macvtap boundary into the host tap driver; this is the same adjacent virtual-network path as CVE-2024-41090, not a remote Internet packet to the host stack.\nAC:L - An attacker controls the virtio TX virtqueue and can reliably submit frames shorter than ETH_HLEN or force build_skb failures; each batch can leak up to 64 page-frags and be repeated in a tight loop without race conditions.\nPR:N - In the highest-impact cloud-KVM scenario, a malicious VM tenant needs no host credentials or capabilities—only the ability to send packets from inside an already-provisioned guest using virtio-net.\nUI:N - Exploitation requires no action from the host administrator or any other user beyond normal VM operation; the guest attacker drives the virtqueue directly.\nS:C - The leak occurs in the host kernel while processing guest-supplied descriptors, crossing the VM/host security boundary and degrading host-wide availability beyond the guest’s own security scope.\nC:N - This is a missing put_page on error paths causing page-frag retention; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose kernel data.\nI:N - No memory is corrupted or written beyond the leaked page allocation; the bug cannot be leveraged for arbitrary write, code execution, or integrity compromise.\nA:H - Sustained submission of short or failing frames leaks one page-frag per rejected buffer; at scale this exhausts host memory and can trigger OOM kills or host panic, matching the identical tun-side fix analysis."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/net/tap.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
|
||
"lessThan": "8d03e65eb6cfbffec471a6b65416f93679bf3286",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
|
||
"lessThan": "f979971835dddbca86cf99e3b2e2b94a408a1ab2",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
|
||
"lessThan": "3f52a86a482a69294c50a5a2a097bd6f4104990a",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
|
||
"lessThan": "d30aac0fa00ca0afc3e08174cf7f974a66bdcf05",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
|
||
"lessThan": "d68eab61944a9b0826fa2e954e42db1aa3201b7a",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
|
||
"lessThan": "e27c17346628cb56843a83f93ac63c314c00f388",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
|
||
"lessThan": "18a84c35842e19cd3c5534d8cee73d31863f696d",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
|
||
"lessThan": "3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/net/tap.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "4.20",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "4.20",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.259",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.210",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.176",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.143",
|
||
"lessThanOrEqual": "6.6.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.12.94",
|
||
"lessThanOrEqual": "6.12.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.18.36",
|
||
"lessThanOrEqual": "6.18.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "7.0.12",
|
||
"lessThanOrEqual": "7.0.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "7.1",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.20",
|
||
"versionEndExcluding": "5.10.259"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.20",
|
||
"versionEndExcluding": "5.15.210"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.20",
|
||
"versionEndExcluding": "6.1.176"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.20",
|
||
"versionEndExcluding": "6.6.143"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.20",
|
||
"versionEndExcluding": "6.12.94"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.20",
|
||
"versionEndExcluding": "6.18.36"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.20",
|
||
"versionEndExcluding": "7.0.12"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.20",
|
||
"versionEndExcluding": "7.1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/8d03e65eb6cfbffec471a6b65416f93679bf3286"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f979971835dddbca86cf99e3b2e2b94a408a1ab2"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/3f52a86a482a69294c50a5a2a097bd6f4104990a"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/d30aac0fa00ca0afc3e08174cf7f974a66bdcf05"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/d68eab61944a9b0826fa2e954e42db1aa3201b7a"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e27c17346628cb56843a83f93ac63c314c00f388"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/18a84c35842e19cd3c5534d8cee73d31863f696d"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2"
|
||
}
|
||
],
|
||
"title": "tap: free page on error paths in tap_get_user_xdp()",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"x_adpType": "supplier",
|
||
"providerMetadata": {
|
||
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
|
||
"shortName": "siemens-SADP",
|
||
"dateUpdated": "2026-10-15T01:21:34.364Z"
|
||
},
|
||
"affected": [
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "0",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2026-46320",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2026-10-16T15:22:00.850427Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"type": "CWE",
|
||
"cweId": "CWE-401",
|
||
"description": "CWE-401 Missing Release of Memory after Effective Lifetime"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-10-19T19:36:58.167Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |