PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46153 Linux CVE debrief

CVE-2026-46153 is a memory leak vulnerability in the Linux kernel's 802.1Q VLAN subsystem. The flaw exists in `vlan_dev_set_egress_priority()`, which manages egress QoS priority mappings for VLAN devices. When a priority mapping is cleared (by setting `vlan_prio` to 0), the function previously retained the mapping node as a tombstone in the hash table rather than removing it. Repeated set/clear cycles with different skb priorities cause these tombstone nodes to accumulate unbounded, leaking memory until the VLAN device is torn down. The fix deletes mapping nodes when cleared, leveraging RCU protection to safely unlink and free nodes after a grace period. This vulnerability affects systems using VLAN egress QoS mappings that are dynamically modified.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-09
Advisory published
2026-05-28
Advisory updated
2026-06-09

Who should care

System administrators managing Linux hosts with VLAN configurations, particularly those using dynamic QoS policy enforcement or SDN controllers that frequently modify VLAN egress priorities. Cloud providers and hosting environments with multi-tenant VLAN isolation should prioritize patching.

Technical summary

The vulnerability resides in `net/8021q/vlan.c` in the Linux kernel's VLAN device implementation. The `vlan_dev_set_egress_priority()` function maintains a hash table (`egress_priority_map`) mapping skb priorities to VLAN priorities. When userspace clears a mapping by setting `vlan_prio` to 0, the original code converted the mapping to a tombstone (priority 0) rather than deleting the node. Since each distinct skb priority creates a unique hash entry, repeated set/clear operations with varying priorities cause unbounded growth of the hash table. The fix utilizes the existing RCU protection on egress mapping lists to safely unlink nodes immediately and defer actual freeing until after an RCU grace period, preventing memory leaks while maintaining read-side lockless access.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing commits 7dddc74af369 and a52e122c9e4d when available from your Linux distribution
  • Monitor VLAN device memory usage on systems with dynamic egress QoS configuration changes
  • Review systems using `vconfig` or `ip link` commands that modify VLAN egress mappings for signs of memory pressure
  • Consider restricting dynamic VLAN QoS reconfiguration to reduce exposure if patching is delayed

Evidence notes

Vulnerability description confirms memory leak via tombstone accumulation in egress priority hash. Fix confirmed in kernel stable commits. No CVSS score or severity assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46153 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46153

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46153 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46153

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7dddc74af369478ba7f9bc136d0fc1dc4570cb66

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a52e122c9e4d56ad9a03b32c915a199276d989c3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.