net: tun: bound receive headroom

Answer in brief

CVE-2026-81000 records a Unknown severity vulnerability in net: tun: bound receive headroom. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 11, 2026Updated Sep 11, 2026Source checked Sep 11, 2026First seen by HOL Sep 11, 2026Material review Sep 11, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=eaea34b23c46bf17b4a5638be69ab3561854f34b <379d85c7f25f3e05a428225e6b8a65613c6e9b9d \|\| >=eaea34b23c46bf17b4a5638be69ab3561854f34b <e098d9cc8859614a7f7baebc96e32a5a16b18ed2 \|\| >=eaea34b23c46bf17b4a5638be69ab3561854f34b <0ada54ea63e48b9c1608e917ccb7dfadbe86db28 \|\| >=eaea34b23c46bf17b4a5638be69ab3561854f34b <447c9303942c439a117d9b76ce6d6e2116b38ee7	379d85c7f25f3e05a428225e6b8a65613c6e9b9d, e098d9cc8859614a7f7baebc96e32a5a16b18ed2, 0ada54ea63e48b9c1608e917ccb7dfadbe86db28, 447c9303942c439a117d9b76ce6d6e2116b38ee7
Linux/Linuxgeneric	4.6	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 379d85c7f25f3e05a428225e6b8a65613c6e9b9d if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 11, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.

Quoted source text, attributed separately from HOL analysis.