Loading vulnerability…
Linux Kernel TUN/TAP Receive-Headroom Underflow
CVE-2026-81000 is an integer-underflow vulnerability in the Linux kernel TUN/TAP receive path. The tun_get_user() function uses tun->align both for socket-buffer headroom and to determine how much packet data remains linear. Open vSwitch can propagate an oversized headroom request from another port to TUN or TAP. When this value exceeds the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows, producing a negative good_linear value that subsequently wraps when converted to the size_t variable linear. Consequently, tun_alloc_skb() can position skb->data outside the allocated head, potentially causing out-of-bounds memory access and kernel memory corruption.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause kernel memory corruption and denial of service, with potential local privilege escalation and compromise of system confidentiality and integrity. The vulnerability-specific CVSS v3.0 assessment is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploit availability is reported, but active exploitation is not established.
If you can’t patch tonight, do this now.
Until the fix is deployed, restrict untrusted or unnecessary creation and configuration of TUN/TAP interfaces and limit Open vSwitch configurations capable of propagating oversized headroom requests to TUN/TAP ports. Minimize CAP_NET_ADMIN grants and isolate workloads authorized to manage virtual networking. These measures reduce exposure but do not correct the underlying arithmetic error.
Patch, then assume compromise.
Install a distribution-supported kernel update containing the fix titled "net: tun: bound receive headroom," and reboot into the updated kernel unless an applicable vendor-supported live patch is loaded. The fix bounds stored headroom to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset, preserving one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. It also pulls the required protocol byte or Ethernet header into linear data before access. Identified fixed releases include Debian unstable linux source package 7.2.6-1 or later and Bottlerocket kernel branches 6.1.186, 6.12.103, and 6.18.48 or later, as applicable. RHEL systems should apply the matching kpatch updates from RHSA-2026:95587, RHSA-2026:95601, RHSA-2026:95600, RHSA-2026:96090, RHSA-2026:96091, or RHSA-2026:96093 according to their release and running kernel.
1 exploit validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
88 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.