CVE-2026-81000

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: tun: bound receive headroom

tun_get_user() uses tun->align both as skb headroom and when choosing how

much packet data to keep linear. OVS can propagate an oversized headroom

request from another port to TUN or TAP.

When align is larger than the usable space in a one-page skb head,

SKB_MAX_HEAD(align) underflows and the result becomes negative when stored

in good_linear. That value later wraps when assigned to the size_t linear

variable, and tun_alloc_skb() can place skb->data outside the allocated

head.

Bound the headroom stored by TUN to the one-page skb-head budget and the

largest non-sentinel 16-bit skb header offset. Leave one linear byte for

raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.

Also pull the raw-TUN protocol byte and the TAP Ethernet header before

accessing them, so these checks remain safe for nonlinear skbs supplied by

other allocation paths.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References