{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81000", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.812Z", "datePublished": "2026-09-11T19:42:54.181Z", "dateUpdated": "2026-09-11T19:42:54.181Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:42:54.181Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun->align both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb->data outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/tun.c"], "versions": [{"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "379d85c7f25f3e05a428225e6b8a65613c6e9b9d", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "e098d9cc8859614a7f7baebc96e32a5a16b18ed2", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "0ada54ea63e48b9c1608e917ccb7dfadbe86db28", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "447c9303942c439a117d9b76ce6d6e2116b38ee7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/tun.c"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d"}, {"url": "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"}, {"url": "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28"}, {"url": "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7"}], "title": "net: tun: bound receive headroom", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/tun.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "379d85c7f25f3e05a428225e6b8a65613c6e9b9d", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "e098d9cc8859614a7f7baebc96e32a5a16b18ed2", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "0ada54ea63e48b9c1608e917ccb7dfadbe86db28", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "447c9303942c439a117d9b76ce6d6e2116b38ee7", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/tun.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun->align both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb->data outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths."}], "id": "CVE-2026-81000", "lastModified": "2026-09-11T20:19:07.710", "metrics": {}, "published": "2026-09-11T20:19:07.710", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel TUN/TAP: Memory corruption due to oversized headroom request", "id": "2532176", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532176"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tun_get_user() function when processing oversized headroom requests. This can occur if Open vSwitch (OVS) propagates an excessively large headroom request to the TUN or TAP device. Successful exploitation could lead to memory corruption, where network packet data is written outside its intended buffer, potentially causing a denial of service or other system instability."], "name": "CVE-2026-81000", "public_date": "2026-09-11T19:42:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-81000\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-81000\nhttps://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28\nhttps://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d\nhttps://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7\nhttps://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"], "threat_severity": "Important"}

{"created": "2026-09-12T03:15:06.704451+00:00", "updated": "2026-09-12T03:15:06.704457+00:00", "vendors": []}