CVE-2026-81000 net: tun: bound receive headroom
An integer underflow in the Linux kernel TUN driver allows memory corruption, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81000?
CVE-2026-81000 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: tun: bound receive headroom
tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP.
When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head.
Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.
Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.
Which versions are affected by CVE-2026-81000?
How do I fix CVE-2026-81000?
Apply the vendor's patch.
Is CVE-2026-81000 being exploited?
There is no known exploitation of CVE-2026-81000 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as AZL-100232, BELL-CVE-2026-81000, DEBIAN-CVE-2026-81000, GHSA-32hf-vhcc-85c2, UBUNTU-CVE-2026-81000.