CVE-2026-81000

Received Received - Intake

Buffer Overflow in Linux Kernel Tun Driver

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-81000

EUVD

EUVD-2026-76323

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the tun_get_user() function where tun->align is misused as both skb headroom and linear packet data size. When align exceeds the usable space in a one-page skb head, it causes an integer underflow in SKB_MAX_HEAD(align), leading to a negative value. This negative value wraps around when assigned to a size_t variable, potentially placing skb->data outside the allocated head, causing memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's TUN/TAP driver and may not have direct detection commands. Monitor kernel logs for unusual skb allocation errors or crashes related to TUN/TAP interfaces. Check for kernel panics or memory corruption events in system logs.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (DoS) condition by crashing the system or corrupting memory. It may also enable privilege escalation if exploited to execute arbitrary code. Systems using TUN/TAP devices, such as virtual networks or VPNs, are particularly at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to network packet handling in the Linux tun/tap driver. There is no evidence in the provided context that this vulnerability impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, restrict access to TUN/TAP devices and monitor for suspicious network activity.

Hi! I’m here to help you understand CVE-2026-81000. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70