CVE-2026-46320

A flaw was found in the Linux kernel's tap driver. This vulnerability occurs in the tap_get_user_xdp() function, where allocated memory pages are not properly freed when processing rejected network frames. Specifically, if a frame is shorter than the expected Ethernet header length or if memory allocation fails, the error handling paths do not release the previously allocated page. This oversight can lead to a memory leak, as each rejected frame in a batch can cause one page-frag chunk to be leaked, potentially impacting system stability and performance over time.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.