Linux kernel tap_get_user_xdp() page-frag memory leak

CVE-2026-46320 is a Linux kernel memory management flaw in the TAP/XDP transmit path, specifically in tap_get_user_xdp(). The function can reject frames shorter than ETH_HLEN with -EINVAL and can also fail with -ENOMEM when build_skb() returns an error. In the vulnerable implementation, both error paths jump to a common err label without freeing the page previously allocated by vhost_net_build_xdp() for the frame. Because tap_sendmsg() ignores the per-buffer return value and always returns 0, vhost_tx_batch() follows the success path and does not release the page either. As a result, each rejected frame in a batch leaks one page-frag chunk. The fix is to free the allocated page on both affected error paths before skb construction. This issue is described as the TAP-side counterpart of a similar leak previously identified in tun_xdp_one().