CVE-2026-46321— Linux kernel 安全漏洞
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 28
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Linux | Linux | 6100e0237204890269e3f934acfc50d35fd6f319< 0a6f46a9332ad6958992d64d3b3a81a80b2ca940 | affected |
589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2< 0e8211fcf9426f5adddf32516ba0f400ceb9544d | affected | ||
ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146< e915445942af6dcea628bf66d6241641201a0c41 | affected | ||
d5ad89b7d01ed4e66fd04734fc63d6e78536692a< 5b34f9e4fe2f203724a6e893d6df0316b9670057 | affected | ||
049584807f1d797fc3078b68035450a9769eb5c3< 69863ff2720a0e9871f1a5710f2a33a94217fee0 | affected | ||
049584807f1d797fc3078b68035450a9769eb5c3< 37a1c268c2c8090bf4dc552d732bd23ba36f8eb0 | affected | ||
049584807f1d797fc3078b68035450a9769eb5c3< 98c67be9eb9de72465a071949e84a3cdb8fab5a3 | affected | ||
049584807f1d797fc3078b68035450a9769eb5c3< f4feb1e20058e407cb00f45aff47f5b7e19a6bbf | affected | ||
| … +20 more rows | |||
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-46321の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
tun: free page on short-frame rejection in tun_xdp_one()
ソース: NVD (National Vulnerability Database)
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk. A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于tun_xdp_one()函数在拒绝短帧时未释放vhost_net_build_xdp()分配的页面，导致页面泄漏，可能被本地进程利用耗尽主机内存触发OOM崩溃。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-46321の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-46321のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-46321 补丁与修复 (7)
Same Patch Batch · Linux · 2026-06-09 · 21 CVEs total
| CVE-2026-46325 | 9.8 CRITICAL | RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE |
| CVE-2026-46316 | 9.3 CRITICAL | KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry |
| CVE-2026-46317 | 8.8 HIGH | KVM: arm64: Reassign nested_mmus array behind mmu_lock |
| CVE-2026-46326 | 8.4 HIGH | iio: pressure: mprls0025pa: fix spi_transfer struct initialisation |
| CVE-2026-46332 | 8.0 HIGH | greybus: gb-beagleplay: bound bootloader receive buffering |
| CVE-2026-52907 | 7.8 HIGH | media: rockchip: rkcif: fix off by one bugs |
| CVE-2026-46319 | 7.8 HIGH | net/sched: act_ct: Only release RCU read lock after ct_ft |
| CVE-2026-46330 | 7.8 HIGH | Revert "net/smc: Introduce TCP ULP support" |
| CVE-2026-46323 | 7.8 HIGH | net: gro: don't merge zcopy skbs |
| CVE-2026-46327 | 7.8 HIGH | dm: fix unlocked test for dm_suspended_md |
| CVE-2026-46324 | 7.8 HIGH | netfilter: nf_tables: use list_del_rcu for netlink hooks |
| CVE-2026-52906 | 7.7 HIGH | 9p: fix access mode flags being ORed instead of replaced |
| CVE-2026-46320 | 7.4 HIGH | tap: free page on error paths in tap_get_user_xdp() |
| CVE-2026-46328 | 7.3 HIGH | apparmor: fix rlimit for posix cpu timers |
| CVE-2026-46322 | 7.1 HIGH | tun: free page on build_skb failure in tun_xdp_one() |
| CVE-2026-46329 | erofs: handle end of filesystem properly for file-backed mounts | |
| CVE-2026-46318 | Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" | |
| CVE-2026-52904 | drm/nouveau: fix nvkm_device leak on aperture removal failure | |
| CVE-2026-52905 | mm/damon/core: disallow non-power of two min_region_sz on damon_start() | |
| CVE-2026-46315 | io_uring/waitid: clear waitid info before copying it to userspace |
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-53362
ipv6: account for fraggap on the paged allocation path - CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc(). - CVE-2026-53360
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected - CVE-2026-53358
Bluetooth: L2CAP: use chan timer to close channels in cleanu
同じベンダー: Linux
- CVE-2026-53362
ipv6: account for fraggap on the paged allocation path - CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc(). - CVE-2026-53360
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected - CVE-2026-53358
Bluetooth: L2CAP: use chan timer to close channels in cleanu
V. CVE-2026-46321へのコメント
まだコメントはありません