CVE-2026-81000

The linux kernel is the core layer that runs the computer. A mistake in its virtual network tunnel feature can allow a user with limited access to damage that core layer and take control, like a tenant finding a way through a service hatch into a building's master control room.

This matters if you run the linux kernel on servers, workstations, appliances, or containers where non-admin users or software can use TUN or TAP virtual network interfaces. No victim action is needed, but the attacker must already have limited access to the machine. It is only a risk if an attacker can access a TUN or TAP interface and send specially made network data.

Attackers with a low-level account can use this flaw to gain full control of an affected system, which makes this a red-priority issue. There is no confirmed real-world exploitation, no public exploit code on record, and it is not listed in CISA's known-exploited catalog, but systems meeting the access condition should be updated promptly.

Confirm exposure by identifying hosts running the linux kernel and reviewing which users, workloads, containers, VPN software, or networking tools can open or receive packets through /dev/net/tun or otherwise use TUN/TAP interfaces. The vulnerable path requires crafted packet data and an oversized alignment/headroom request propagated to TUN or TAP.

Deploy the operating-system vendor kernel update that includes the applicable stable-branch backport: ad715e713610d2d5473c3a6498c825ccecf26491, 708e87937de93f445225c134a2e20519f9b4ce60, 18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76, 010eee265d6bd8769b6a523d2a0693d9b3f5df43, 379d85c7f25f3e05a428225e6b8a65613c6e9b9d, e098d9cc8859614a7f7baebc96e32a5a16b18ed2, 0ada54ea63e48b9c1608e917ccb7dfadbe86db28, or 447c9303942c439a117d9b76ce6d6e2116b38ee7. No release-version mapping was provided, so verify the vendor advisory or source changelog rather than assuming a kernel version is fixed. Reboot after installation and validate the active kernel build.

If patching is delayed, prevent untrusted local users and untrusted containers from accessing TUN/TAP devices; review applications that create virtual tunnel interfaces and restrict that permission to trusted services. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Monitor for unexpected TUN/TAP device use, untrusted processes accessing /dev/net/tun, and signs of local privilege escalation on exposed hosts.

Severity is CVSS 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability is a local kernel memory-corruption issue in tun_get_user(): an oversized tun->align can make SKB_MAX_HEAD(align) underflow, later wrap into size_t, and cause tun_alloc_skb() to position skb->data outside its allocated head. Exploitation requires non-root privileges plus access to a TUN/TAP device and crafted aligned packet data; default reachability is reported as true. EPSS is 0.2% and flat at the 6th percentile. It is not in CISA KEV, no confirmed in-the-wild exploitation is reported, and no public exploit code is on record.