CVE-2026-46153: 8021q: delete cleared egress QoS mappings

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: 8021q: delete cleared egress QoS mappings vlan_dev_set_egress_priority() currently keeps cleared egress priority mappings in the hash as tombstones. Repeated set/clear cycles with distinct skb priorities therefore accumulate mapping nodes until device teardown and leak memory. Delete mappings when vlan_prio is cleared instead of keeping tombstones. Now that the egress mapping lists are RCU protected, the node can be unlinked safely and freed after a grace period.

Affected products

Linux kernel: from 2.6.12.1 before 7.0.7; 2.6.12, 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5 — fixed in 7.0.7

How to fix

Upgrade to a fixed version: Linux kernel 7.0.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-46153 or the next vulnerability affects your stack