LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46153: 8021q: delete cleared egress QoS mappings

In the Linux kernel, the following vulnerability has been resolved: 8021q: delete cleared egress QoS mappings vlan_dev_set_egress_priority() currently keeps cleared egress priority mappings in the hash as tombstones. Repeated set/clear cycles with distinct skb priorities therefore accumulate mapping nodes until device teardown and leak memory. Delete mappings when vlan_prio is cleared instead of keeping tombstones. Now that the egress mapping lists are RCU protected, the node can be unlinked safely and freed after a grace period.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a memory leak in 802.1Q VLAN egress QoS handling. Repeated priority mapping set and clear cycles can leave stale mapping records until the network device is torn down. The practical risk is resource exhaustion on affected systems, but public sources do not provide CVSS, exploit evidence, or distro-specific impact.

Executive priority

Treat this as a targeted kernel maintenance issue, not an emergency based on current evidence. Patch through normal kernel update channels, prioritizing network infrastructure and hosts that actively use VLAN QoS features.

Technical view

vlan_dev_set_egress_priority() kept cleared egress priority mappings as hash tombstones. Repeated set/clear cycles with distinct skb priorities accumulated mapping nodes. The fix deletes mappings when vlan_prio is cleared and frees unlinked nodes after an RCU grace period.

Likely exposure

Exposure appears limited to Linux systems or appliances using 802.1Q VLAN egress QoS mappings. The source bundle does not identify affected distributions, privilege requirements, container reachability, or remote network exploitability.

Exploitation context

CISA KEV is false, and the provided sources do not report active exploitation or public exploit details. The described condition requires repeated manipulation of VLAN egress QoS mappings, but triggering requirements are not fully documented.

Researcher notes

The CVE record provides root cause and fix direction but lacks CVSS, CWE, exploitability, and distro mapping. Analysis should stay scoped to Linux 8021q egress QoS mapping behavior and the two referenced stable commits.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Check distribution or appliance vendor advisories for backported packages.
  • Prioritize systems using VLAN egress QoS mapping or network virtualization.
  • Monitor affected systems for unexplained kernel memory growth until patched.
  • Avoid inventing compensating controls; follow vendor guidance when available.

Validation and detection

  • Inventory Linux kernel versions and vendor kernel package status.
  • Identify hosts using 802.1Q VLAN egress QoS mappings.
  • Confirm installed kernels include the referenced stable commits or vendor backports.
  • Review monitoring for sustained memory growth on VLAN-heavy systems.
  • Validate updates in staging before production rollout.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46153 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux2.6.12, 0, 7.0.7, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.