CVE-2026-46321

A flaw was found in the Linux kernel. A local attacker with access to the tun/tap device can exploit this vulnerability. By sending network frames shorter than the expected header length, the system fails to free allocated memory pages, leading to memory leaks. This can exhaust system memory, resulting in a denial of service (DoS) and causing the system to crash.

This vulnerability is rated as Moderate because successful exploitation is limited to a local denial-of-service condition without compromising system confidentiality or integrity, and it requires access to specific character devices (/dev/net/tun and /dev/vhost-net). In standard Red Hat Enterprise Linux environments, unprivileged users do not typically possess permissions to configure tun/tap interfaces or interact directly with vhost-net devices. Additionally, earlier platforms including Red Hat Enterprise Linux 7, 8, and 9 do not contain the vulnerable code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.