AI description
CVE-2026-81000, dubbed "TUNderflow," is an integer underflow vulnerability found within the Linux kernel's TUN/TAP driver. Specifically, the flaw resides in the `tun_get_user()` function, which is responsible for handling receive headroom requests. This issue arises when the system processes an oversized headroom request, particularly if Open vSwitch (OVS) propagates an excessively large request to a TUN or TAP device. The vulnerability can lead to memory corruption, where network packet data is written beyond its allocated buffer. This out-of-bounds write can result in unintended system behavior or instability.
- Description
- In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- NVD status
- Received
CVSS 3.1
- Type
- Secondary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- Hype score
- Not currently trending
@CloudLinuxOS What's the current CL8 kernel fix status for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469?
@manuelfr51
30 Sept 2026
31 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
9/18以降に追っているのは正確にはLPE 8件です。 CVE-2026-80844 CVE-2026-81000 CVE-2026-68121 CVE-2026-74469 CVE-2026-74753 CVE-2026-52910 CVE-2026-80521 CVE未採番：RustyTux / strparser・ESP-in-TCP race LPE 9/23まで、これ全部緩和策がわかるも
@hacker_infra
23 Sept 2026
426 Impressions
0 Retweets
7 Likes
1 Bookmark
0 Replies
0 Quotes
red hatで正式に受理されてる。 緩和策は専用ページに合ったはず。 Hi OS開発者, Your request PSIRTSUPT-24215: Public LPE PoCs for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469 has been resolved. This request is now closed. If you h
@hacker_infra
22 Sept 2026
232 Impressions
0 Retweets
2 Likes
1 Bookmark
0 Replies
0 Quotes
Four Linux local-root vulns published with working PoCs. DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Write-up + exploits dropped after coordinated disclosure. https://t.co/K7AjqePWEf https://t.co/8RpBiQgxEN
@PadhiyarRushi
19 Sept 2026
3897 Impressions
18 Retweets
52 Likes
52 Bookmarks
2 Replies
1 Quote
News: Asim Manizada published local-root PoCs for four Linux kernel bugs (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469). Hits unpatched multi-user hosts. Patch to a fixed kernel (6.12.109+ or your distro advisory). https://t.co/epX3rBZCdG
@snakeyesV1
19 Sept 2026
62 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Public exploits are out for four Linux kernel LPE flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469). Disabling unprivileged user namespaces limits exposure until patched. https://t.co/WjH2VyXgG9 https://t.co/QC14eBVf0C #2workly
@2Workly
18 Sept 2026
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Cuatro fallos en el núcleo de Linux permiten acceso root Se han revelado cuatro nuevas vulnerabilidades en el núcleo de Linux ( CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 y CVE-2026-74469 ) https://t.co/1OcVOhRSPz
@elhackernet
18 Sept 2026
5499 Impressions
50 Retweets
140 Likes
29 Bookmarks
1 Reply
1 Quote
🚨 Linux kernel'de 4 kritik LPE açığı için public exploit yayınlandı! CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 ve CVE-2026-74469 için çalışan PoC / Exploit github üzerinden yayınlandı. Açıklar; IPsec AH6, TUN/TAP, PPPoE ve SCTP bileşenlerindeki bellek g
@ridvanyagli
18 Sept 2026
692 Impressions
4 Retweets
12 Likes
5 Bookmarks
0 Replies
0 Quotes
News: Four Linux kernel bugs give local root: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Hits many kernels. Update to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4. https://t.co/d6MF0JA29w
@snakeyesV1
18 Sept 2026
57 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
いきなり4つのLPE 緩和策 CVE-2026-80844 (DirtyAH6): The vulnerability requires the IPv6 AH6/XFRM path. On systems where IPv6 is not required, IPv6 can be disabled at boot: grubby --update-kernel=ALL --args="ipv6.disable=1" A reboot is required. CVE-2026-81000 (TUNder
@hacker_infra
18 Sept 2026
13 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes