{"id":"CVE-2026-81000","title":"net: tun: bound receive headroom","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun->align both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversi…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < ad715e713610d2d5473c3a6498c825ccecf26491","Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 708e87937de93f445225c134a2e20519f9b4ce60","Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76","Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 010eee265d6bd8769b6a523d2a0693d9b3f5df43","Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 379d85c7f25f3e05a428225e6b8a65613c6e9b9d","Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < e098d9cc8859614a7f7baebc96e32a5a16b18ed2","Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 0ada54ea63e48b9c1608e917ccb7dfadbe86db28","Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 447c9303942c439a117d9b76ce6d6e2116b38ee7","Linux 4.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:22:04.024628Z"},"exploitAvailable":true,"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:46:24.640Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81000","references":[{"url":"https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491"},{"url":"https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60"},{"url":"https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76"},{"url":"https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43"},{"url":"https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d"},{"url":"https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"},{"url":"https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28"},{"url":"https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81000.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-81000"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532176"},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-011"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81000"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81000"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81000.mbox"},{"url":"https://access.redhat.com/errata/RHSA-2026:73788"},{"url":"https://access.redhat.com/errata/RHSA-2026:71687"},{"url":"https://access.redhat.com/errata/RHSA-2026:71657"},{"url":"https://access.redhat.com/errata/RHSA-2026:79035"},{"url":"https://access.redhat.com/errata/RHSA-2026:74433"},{"url":"https://access.redhat.com/errata/RHSA-2026:74377"},{"url":"https://access.redhat.com/errata/RHSA-2026:74379"},{"url":"https://access.redhat.com/errata/RHSA-2026:74428"},{"url":"https://access.redhat.com/errata/RHSA-2026:71599"},{"url":"https://access.redhat.com/errata/RHSA-2026:71233"},{"url":"https://access.redhat.com/errata/RHSA-2026:71601"},{"url":"https://access.redhat.com/errata/RHSA-2026:71569"},{"url":"https://access.redhat.com/errata/RHSA-2026:71631"},{"url":"https://access.redhat.com/errata/RHSA-2026:71232"},{"url":"https://access.redhat.com/errata/RHSA-2026:71213"},{"url":"https://access.redhat.com/errata/RHSA-2026:71565"},{"url":"https://access.redhat.com/errata/RHSA-2026:71592"},{"url":"https://access.redhat.com/errata/RHSA-2026:71594"},{"url":"https://access.redhat.com/errata/RHSA-2026:71016"},{"url":"https://access.redhat.com/errata/RHSA-2026:71606"}],"tags":["cve.org","exploit-available","csaf","vex","red-hat"],"epss":0.00357,"epssPercentile":0.29247,"exploits":{"github":3,"githubRepos":["https://github.com/suominen/tunderflow","https://github.com/0xBlackash/CVE-2026-81000","https://github.com/HORKimhab/CVE-2026-81000"],"checkedAt":"2026-10-27T19:15:04.035Z"},"patched":["nvidia_for_rhel 10","enterprise_linux_server_v_7_els","enterprise_linux_for_real_time_v_7_els","enterprise_linux_server_optional_v_7_els","openshift_container_platform 4.18","openshift_container_platform 4.19","openshift_container_platform 4.20","openshift_container_platform 4.21","openshift_container_platform 4.22","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_eus_extension_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_e4s_v_9_4","enterprise_linux_baseos_eus_v_9_6","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","codeready_linux_builder_eus_v_9_6","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_eus_v_10_0","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_nfv_v_8","enterprise_linux_real_time_for_nfv_e4s_v_9_2","enterprise_linux_real_time_for_nfv_e4s_v_9_4","enterprise_linux_real_time_for_nfv_eus_v_9_6","enterprise_linux_real_time_for_nfv_v_9"],"ingestedAt":"2026-09-14T15:23:07.454Z","slug":"CVE-2026-81000","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun->align both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb->data outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths.\n\n## Affected\n\n- `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < ad715e713610d2d5473c3a6498c825ccecf26491`\n- `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 708e87937de93f445225c134a2e20519f9b4ce60`\n- `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76`\n- `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 010eee265d6bd8769b6a523d2a0693d9b3f5df43`\n- `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 379d85c7f25f3e05a428225e6b8a65613c6e9b9d`\n- `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < e098d9cc8859614a7f7baebc96e32a5a16b18ed2`\n- `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 0ada54ea63e48b9c1608e917ccb7dfadbe86db28`\n- `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 447c9303942c439a117d9b76ce6d6e2116b38ee7`\n- `Linux 4.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:73788** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73788)\n- **RHSA-2026:71687** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71687)\n- **RHSA-2026:71657** · Red Hat · fixed in: Red Hat Enterprise Linux for Real Time (v. 7 ELS) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71657)\n- **RHSA-2026:79035** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:79035)\n- **RHSA-2026:74433** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-10-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:74433)\n- **RHSA-2026:74377** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:74377)\n- **RHSA-2026:74379** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:74379)\n- **RHSA-2026:74428** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:74428)\n- **RHSA-2026:71599** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71599)\n- **RHSA-2026:71233** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71233)\n- **RHSA-2026:71601** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71601)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81000.json)\n- **RHSA-2026:71569** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71569)\n- **RHSA-2026:71631** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71631)\n- **RHSA-2026:71232** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71232)\n- **RHSA-2026:71213** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71213)\n- **RHSA-2026:71565** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71565)\n- **RHSA-2026:71592** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71592)\n- **RHSA-2026:71016** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71016)","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":208488,"id":"CVE-2026-81000","ts":1790005719113,"field":"cvss","old":"7","new":"7.8"},{"seq":208063,"id":"CVE-2026-81000","ts":1789922701014,"field":"exploit_available","old":"false","new":"true"},{"seq":208062,"id":"CVE-2026-81000","ts":1789922701014,"field":"cvss","old":"7.8","new":"7"},{"seq":183809,"id":"CVE-2026-81000","ts":1789356677483,"field":"cvss","old":"7.8","new":"6.4"},{"seq":183808,"id":"CVE-2026-81000","ts":1789356677483,"field":"severity","old":"high","new":"medium"},{"seq":153190,"id":"CVE-2026-81000","ts":1789285349479,"field":"cvss","old":null,"new":"7.8"},{"seq":153189,"id":"CVE-2026-81000","ts":1789285349479,"field":"severity","old":"none","new":"high"},{"seq":147658,"id":"CVE-2026-81000","ts":1789270211772,"field":"cvss","old":null,"new":"6.4"},{"seq":147657,"id":"CVE-2026-81000","ts":1789270211772,"field":"severity","old":"none","new":"medium"},{"seq":109414,"id":"CVE-2026-81000","ts":1789183731821,"field":"cvss","old":null,"new":"6.4"},{"seq":109413,"id":"CVE-2026-81000","ts":1789183731821,"field":"severity","old":"none","new":"medium"}]}