--- id: CVE-2026-81000 title: 'net: tun: bound receive headroom' summary: |- In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversi… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cvssSource: cna cwe: - CWE-787 vendor: Linux product: Linux affected: - >- Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < ad715e713610d2d5473c3a6498c825ccecf26491 - >- Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 708e87937de93f445225c134a2e20519f9b4ce60 - >- Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76 - >- Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 010eee265d6bd8769b6a523d2a0693d9b3f5df43 - >- Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 379d85c7f25f3e05a428225e6b8a65613c6e9b9d - >- Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < e098d9cc8859614a7f7baebc96e32a5a16b18ed2 - >- Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 0ada54ea63e48b9c1608e917ccb7dfadbe86db28 - >- Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 447c9303942c439a117d9b76ce6d6e2116b38ee7 - Linux 4.6 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-16T19:22:04.024628Z' exploitAvailable: true published: '2026-09-11' updated: '2026-10-19' sourceUpdated: '2026-10-19T08:46:24.640Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81000' references: - url: 'https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491' - url: 'https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60' - url: 'https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76' - url: 'https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43' - url: 'https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d' - url: 'https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2' - url: 'https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28' - url: 'https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81000.json - url: 'https://access.redhat.com/security/cve/CVE-2026-81000' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532176' - url: 'https://access.redhat.com/security/vulnerabilities/RHSB-2026-011' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-81000' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81000' - url: >- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81000.mbox - url: 'https://access.redhat.com/errata/RHSA-2026:73788' - url: 'https://access.redhat.com/errata/RHSA-2026:71687' - url: 'https://access.redhat.com/errata/RHSA-2026:71657' - url: 'https://access.redhat.com/errata/RHSA-2026:79035' - url: 'https://access.redhat.com/errata/RHSA-2026:74433' - url: 'https://access.redhat.com/errata/RHSA-2026:74377' - url: 'https://access.redhat.com/errata/RHSA-2026:74379' - url: 'https://access.redhat.com/errata/RHSA-2026:74428' - url: 'https://access.redhat.com/errata/RHSA-2026:71599' - url: 'https://access.redhat.com/errata/RHSA-2026:71233' - url: 'https://access.redhat.com/errata/RHSA-2026:71601' - url: 'https://access.redhat.com/errata/RHSA-2026:71569' - url: 'https://access.redhat.com/errata/RHSA-2026:71631' - url: 'https://access.redhat.com/errata/RHSA-2026:71232' - url: 'https://access.redhat.com/errata/RHSA-2026:71213' - url: 'https://access.redhat.com/errata/RHSA-2026:71565' - url: 'https://access.redhat.com/errata/RHSA-2026:71592' - url: 'https://access.redhat.com/errata/RHSA-2026:71594' - url: 'https://access.redhat.com/errata/RHSA-2026:71016' - url: 'https://access.redhat.com/errata/RHSA-2026:71606' tags: - cve.org - exploit-available - csaf - vex - red-hat epss: 0.00357 epssPercentile: 0.29247 exploits: github: 3 githubRepos: - 'https://github.com/suominen/tunderflow' - 'https://github.com/0xBlackash/CVE-2026-81000' - 'https://github.com/HORKimhab/CVE-2026-81000' checkedAt: '2026-10-27T19:15:04.035Z' patched: - nvidia_for_rhel 10 - enterprise_linux_server_v_7_els - enterprise_linux_for_real_time_v_7_els - enterprise_linux_server_optional_v_7_els - openshift_container_platform 4.18 - openshift_container_platform 4.19 - openshift_container_platform 4.20 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_eus_extension_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_baseos_e4s_v_9_2 - enterprise_linux_baseos_e4s_v_9_4 - enterprise_linux_baseos_eus_v_9_6 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_eus_v_10_0 - enterprise_linux_codeready_linux_builder_v_10 - enterprise_linux_crb_v_8 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 - enterprise_linux_real_time_for_nfv_eus_v_10_0 - enterprise_linux_real_time_for_nfv_v_10 - enterprise_linux_nfv_v_8 - enterprise_linux_real_time_for_nfv_e4s_v_9_2 - enterprise_linux_real_time_for_nfv_e4s_v_9_4 - enterprise_linux_real_time_for_nfv_eus_v_9_6 - enterprise_linux_real_time_for_nfv_v_9 ingestedAt: '2026-09-14T15:23:07.454Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths. ## Affected - `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < ad715e713610d2d5473c3a6498c825ccecf26491` - `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 708e87937de93f445225c134a2e20519f9b4ce60` - `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76` - `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 010eee265d6bd8769b6a523d2a0693d9b3f5df43` - `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 379d85c7f25f3e05a428225e6b8a65613c6e9b9d` - `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < e098d9cc8859614a7f7baebc96e32a5a16b18ed2` - `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 0ada54ea63e48b9c1608e917ccb7dfadbe86db28` - `Linux >= eaea34b23c46bf17b4a5638be69ab3561854f34b < 447c9303942c439a117d9b76ce6d6e2116b38ee7` - `Linux 4.6` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:73788** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73788) - **RHSA-2026:71687** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71687) - **RHSA-2026:71657** · Red Hat · fixed in: Red Hat Enterprise Linux for Real Time (v. 7 ELS) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71657) - **RHSA-2026:79035** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:79035) - **RHSA-2026:74433** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-10-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:74433) - **RHSA-2026:74377** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:74377) - **RHSA-2026:74379** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:74379) - **RHSA-2026:74428** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:74428) - **RHSA-2026:71599** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71599) - **RHSA-2026:71233** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71233) - **RHSA-2026:71601** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71601) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81000.json) - **RHSA-2026:71569** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71569) - **RHSA-2026:71631** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71631) - **RHSA-2026:71232** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71232) - **RHSA-2026:71213** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71213) - **RHSA-2026:71565** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71565) - **RHSA-2026:71592** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71592) - **RHSA-2026:71016** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71016)