« Volver al listado

CVE-2026-81000

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

net: tun: bound receive headroom

tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP.

When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head.

Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.

Leer descripción completaMostrar menos

Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vuln local (AV:L/PR:L) en kernel Linux que causa desbordamiento de memoria (SKB_MAX_HEAD underflow) permitiendo ejecución de código o denegación de servicio por corrupción de estructuras kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationFilter Network Traffic

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-81000",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "lessThan": "ad715e713610d2d5473c3a6498c825ccecf26491",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "lessThan": "708e87937de93f445225c134a2e20519f9b4ce60",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "lessThan": "18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "lessThan": "010eee265d6bd8769b6a523d2a0693d9b3f5df43",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "lessThan": "379d85c7f25f3e05a428225e6b8a65613c6e9b9d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "lessThan": "e098d9cc8859614a7f7baebc96e32a5a16b18ed2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "lessThan": "0ada54ea63e48b9c1608e917ccb7dfadbe86db28",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "lessThan": "447c9303942c439a117d9b76ce6d6e2116b38ee7",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:07.710",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun->align both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb->data outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths."
    }
  ],
  "lastModified": "2026-09-14T13:18:54.210",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}