AI description
CVE-2026-81000, dubbed "TUNderflow," is an integer underflow vulnerability found within the Linux kernel's TUN/TAP driver. Specifically, the flaw resides in the `tun_get_user()` function, which is responsible for handling receive headroom requests. This issue arises when the system processes an oversized headroom request, particularly if Open vSwitch (OVS) propagates an excessively large request to a TUN or TAP device. The vulnerability can lead to memory corruption, where network packet data is written beyond its allocated buffer. This out-of-bounds write can result in unintended system behavior or instability.
- Description
- In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- NVD status
- Received
CVSS 3.1
- Type
- Secondary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
13
Four Linux local-root vulns published with working PoCs. DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Write-up + exploits dropped after coordinated disclosure. https://t.co/K7AjqePWEf https://t.co/8RpBiQgxEN
@PadhiyarRushi
19 Sept 2026
1059 Impressions
0 Retweets
18 Likes
14 Bookmarks
2 Replies
0 Quotes
News: Asim Manizada published local-root PoCs for four Linux kernel bugs (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469). Hits unpatched multi-user hosts. Patch to a fixed kernel (6.12.109+ or your distro advisory). https://t.co/epX3rBZCdG
@snakeyesV1
19 Sept 2026
62 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Public exploits are out for four Linux kernel LPE flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469). Disabling unprivileged user namespaces limits exposure until patched. https://t.co/WjH2VyXgG9 https://t.co/QC14eBVf0C #2workly
@2Workly
18 Sept 2026
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Cuatro fallos en el núcleo de Linux permiten acceso root Se han revelado cuatro nuevas vulnerabilidades en el núcleo de Linux ( CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 y CVE-2026-74469 ) https://t.co/1OcVOhRSPz
@elhackernet
18 Sept 2026
5499 Impressions
50 Retweets
140 Likes
29 Bookmarks
1 Reply
1 Quote
🚨 Linux kernel'de 4 kritik LPE açığı için public exploit yayınlandı! CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 ve CVE-2026-74469 için çalışan PoC / Exploit github üzerinden yayınlandı. Açıklar; IPsec AH6, TUN/TAP, PPPoE ve SCTP bileşenlerindeki bellek g
@ridvanyagli
18 Sept 2026
692 Impressions
4 Retweets
12 Likes
5 Bookmarks
0 Replies
0 Quotes
News: Four Linux kernel bugs give local root: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Hits many kernels. Update to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4. https://t.co/d6MF0JA29w
@snakeyesV1
18 Sept 2026
57 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
いきなり4つのLPE 緩和策 CVE-2026-80844 (DirtyAH6): The vulnerability requires the IPv6 AH6/XFRM path. On systems where IPv6 is not required, IPv6 can be disabled at boot: grubby --update-kernel=ALL --args="ipv6.disable=1" A reboot is required. CVE-2026-81000 (TUNder
@hacker_infra
18 Sept 2026
13 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes