CyberSecBulletin
CVE-2026-46322NVD status: Modified

Linux: Missing Release of Memory after Effective Lifetime

Published Updated By the CyberSecBulletin desk

CVE-2026-46322 is a high-severity missing release of memory after effective lifetime vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, without any action from a user. The record lists versions 26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9, 793385c154771603b8671dd8338927221e9d8d78, 2638a9c1521905bb5c5d1e95c8fbc09f79148ed7 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9 or 793385c154771603b8671dd8338927221e9d8d78 or 2638a9c1521905bb5c5d1e95c8fbc09f79148ed7 or 60d9c0d6cdde5420d6483c921b16fe5465eb5238, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux043d222f93ab8c76b56a3b315cd8692e35affb6c up to, but not including, 26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9; 043d222f93ab8c76b56a3b315cd8692e35affb6c up to, but not including, 793385c154771603b8671dd8338927221e9d8d78; 043d222f93ab8c76b56a3b315cd8692e35affb6c up to, but not including, 2638a9c1521905bb5c5d1e95c8fbc09f79148ed7; 043d222f93ab8c76b56a3b315cd8692e35affb6c up to, but not including, 60d9c0d6cdde5420d6483c921b16fe5465eb5238; 043d222f93ab8c76b56a3b315cd8692e35affb6c up to, but not including, d16e38fac09a47bfcf98c1ad65a1bb53f94540f5; 043d222f93ab8c76b56a3b315cd8692e35affb6c up to, but not including, aa308e9dbb9acb17cacdbbce9e4504f69bac8385; 043d222f93ab8c76b56a3b315cd8692e35affb6c up to, but not including, 4fefc6156a162a9f50035c12091a5e5130c82c6e; 043d222f93ab8c76b56a3b315cd8692e35affb6c up to, but not including, aa8963fdce667a42fb7f0bdd2909fadcab02f9a8; and 1 more ranges26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9, 793385c154771603b8671dd8338927221e9d8d78, 2638a9c1521905bb5c5d1e95c8fbc09f79148ed7, 60d9c0d6cdde5420d6483c921b16fe5465eb5238, d16e38fac09a47bfcf98c1ad65a1bb53f94540f5, aa308e9dbb9acb17cacdbbce9e4504f69bac8385
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel4.20 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.15.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

How developers prevent this class of flaw

  • Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. For example, glibc in Linux provides protection against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic reference counting (ARC). To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std
  • Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

More Missing Release of Memory after Effective Lifetime vulnerabilities (CWE-401)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Missing Release of Memory after Effective Lifetime vulnerabilities

Spotted an error? Tell us.