CVE-2026-81000

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81000", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.812Z", "datePublished": "2026-09-11T19:42:54.181Z", "dateUpdated": "2026-10-19T08:46:24.640Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:46:24.640Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun->align both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb->data outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - tun_get_user() runs on write/sendmsg to /dev/net/tun after ndo_set_rx_headroom stores an oversized tun->align. That is a local tun/tap injection path, not parsing of frames received from a remote peer.\nAC:L - The attacker fully controls both sides: inflate rx headroom via netkit IFLA_NETKIT_HEADROOM or the OVS/veth/VXLAN and bridge/veth/GRETAP loops, then write a TUN frame. No race or uninfluenced victim state is required.\nPR:L - TUNSETIFF uses ns_capable(net->user_ns, CAP_NET_ADMIN) and OVS vport commands use GENL_UNS_ADMIN_PERM, so an unprivileged user with a user+net namespace can create the topology and trigger the write.\nUI:N - The attacker opens /dev/net/tun, configures local net devices, and writes the frame; no separate victim action is required.\nS:U - The out-of-bounds access occurs in the same kernel that handles the local TUN write and yields privilege escalation within that kernel, not a VM/IOMMU boundary crossing.\nC:H - SKB_MAX_HEAD underflow wraps the linear length so tun_alloc_skb()/skb_reserve() can place skb->data outside the allocated head, turning later header reads and packet processing into out-of-bounds kernel reads.\nI:H - After skb->data is moved outside the allocated head, skb_copy_datagram_from_iter copies attacker-controlled frame bytes relative to that pointer, an out-of-bounds write usable for kernel corruption and control-flow hijacking.\nA:H - The misplaced skb leads to a kernel oops, BUG() in eth_type_trans/__skb_pull on a nonlinear TAP skb, or panic when the out-of-bounds access is hit."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/tun.c"], "versions": [{"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "ad715e713610d2d5473c3a6498c825ccecf26491", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "708e87937de93f445225c134a2e20519f9b4ce60", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "010eee265d6bd8769b6a523d2a0693d9b3f5df43", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "379d85c7f25f3e05a428225e6b8a65613c6e9b9d", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "e098d9cc8859614a7f7baebc96e32a5a16b18ed2", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "0ada54ea63e48b9c1608e917ccb7dfadbe86db28", "status": "affected", "versionType": "git"}, {"version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "447c9303942c439a117d9b76ce6d6e2116b38ee7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/tun.c"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491"}, {"url": "https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60"}, {"url": "https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76"}, {"url": "https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43"}, {"url": "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d"}, {"url": "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"}, {"url": "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28"}, {"url": "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7"}], "title": "net: tun: bound receive headroom", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-81000", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:22:04.024628Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:38.160Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-81000", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:22:04.024628Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:22:04.837Z"}}], "cna": {"title": "net: tun: bound receive headroom", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - tun_get_user() runs on write/sendmsg to /dev/net/tun after ndo_set_rx_headroom stores an oversized tun->align. That is a local tun/tap injection path, not parsing of frames received from a remote peer.\nAC:L - The attacker fully controls both sides: inflate rx headroom via netkit IFLA_NETKIT_HEADROOM or the OVS/veth/VXLAN and bridge/veth/GRETAP loops, then write a TUN frame. No race or uninfluenced victim state is required.\nPR:L - TUNSETIFF uses ns_capable(net->user_ns, CAP_NET_ADMIN) and OVS vport commands use GENL_UNS_ADMIN_PERM, so an unprivileged user with a user+net namespace can create the topology and trigger the write.\nUI:N - The attacker opens /dev/net/tun, configures local net devices, and writes the frame; no separate victim action is required.\nS:U - The out-of-bounds access occurs in the same kernel that handles the local TUN write and yields privilege escalation within that kernel, not a VM/IOMMU boundary crossing.\nC:H - SKB_MAX_HEAD underflow wraps the linear length so tun_alloc_skb()/skb_reserve() can place skb->data outside the allocated head, turning later header reads and packet processing into out-of-bounds kernel reads.\nI:H - After skb->data is moved outside the allocated head, skb_copy_datagram_from_iter copies attacker-controlled frame bytes relative to that pointer, an out-of-bounds write usable for kernel corruption and control-flow hijacking.\nA:H - The misplaced skb leads to a kernel oops, BUG() in eth_type_trans/__skb_pull on a nonlinear TAP skb, or panic when the out-of-bounds access is hit."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "ad715e713610d2d5473c3a6498c825ccecf26491", "versionType": "git"}, {"status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "708e87937de93f445225c134a2e20519f9b4ce60", "versionType": "git"}, {"status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76", "versionType": "git"}, {"status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "010eee265d6bd8769b6a523d2a0693d9b3f5df43", "versionType": "git"}, {"status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "379d85c7f25f3e05a428225e6b8a65613c6e9b9d", "versionType": "git"}, {"status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "e098d9cc8859614a7f7baebc96e32a5a16b18ed2", "versionType": "git"}, {"status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "0ada54ea63e48b9c1608e917ccb7dfadbe86db28", "versionType": "git"}, {"status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "lessThan": "447c9303942c439a117d9b76ce6d6e2116b38ee7", "versionType": "git"}], "programFiles": ["drivers/net/tun.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"status": "unaffected", "version": "0", "lessThan": "4.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.109", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/tun.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491"}, {"url": "https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60"}, {"url": "https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76"}, {"url": "https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43"}, {"url": "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d"}, {"url": "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"}, {"url": "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28"}, {"url": "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun->align both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb->data outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.270", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.221", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.188", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.157", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.109", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.50", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.4", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.3", "versionStartIncluding": "4.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:46:24.640Z"}}}, "cveMetadata": {"cveId": "CVE-2026-81000", "state": "PUBLISHED", "dateUpdated": "2026-10-19T08:46:24.640Z", "dateReserved": "2026-08-26T14:34:25.812Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-09-11T19:42:54.181Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/tun.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ad715e713610d2d5473c3a6498c825ccecf26491", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "708e87937de93f445225c134a2e20519f9b4ce60", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "010eee265d6bd8769b6a523d2a0693d9b3f5df43", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "379d85c7f25f3e05a428225e6b8a65613c6e9b9d", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "e098d9cc8859614a7f7baebc96e32a5a16b18ed2", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "0ada54ea63e48b9c1608e917ccb7dfadbe86db28", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}, {"lessThan": "447c9303942c439a117d9b76ce6d6e2116b38ee7", "status": "affected", "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/tun.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun->align both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb->data outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths."}], "id": "CVE-2026-81000", "lastModified": "2026-10-19T09:17:33.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81000", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:22:04.024628Z", "version": "2.0.3"}}]}, "published": "2026-09-11T20:19:07.710", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel TUN/TAP: Memory corruption due to oversized headroom request", "id": "2532176", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532176"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tun_get_user() function when processing oversized headroom requests. This can occur if Open vSwitch (OVS) propagates an excessively large headroom request to the TUN or TAP device. Successful exploitation could lead to memory corruption, where network packet data is written outside its intended buffer, potentially causing a denial of service or other system instability."], "name": "CVE-2026-81000", "public_date": "2026-09-11T19:42:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-81000\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-81000\nhttps://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28\nhttps://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d\nhttps://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7\nhttps://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eaea34b23c46bf17b4a5638be69ab3561854f34b,379d85c7f25f3e05a428225e6b8a65613c6e9b9d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eaea34b23c46bf17b4a5638be69ab3561854f34b,e098d9cc8859614a7f7baebc96e32a5a16b18ed2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eaea34b23c46bf17b4a5638be69ab3561854f34b,0ada54ea63e48b9c1608e917ccb7dfadbe86db28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eaea34b23c46bf17b4a5638be69ab3561854f34b,447c9303942c439a117d9b76ce6d6e2116b38ee7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T03:15:06.704451+00:00", "updated": "2026-09-21T02:45:08.183094+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}