Skip to main content

Linux Kernel EUVDEUVD-2026-38710

| CVE-2026-52940 MEDIUM
2026-06-24 Linux GHSA-7mf5-pgq8-jhcp
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required; sole real-world impact is kernel stack confidentiality disclosure; no integrity or availability effect present.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 19:25 vuln.today
CVSS changed
Jul 08, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

tun: zero the whole vnet header in tun_put_user()

tun_put_user() declares an on-stack struct virtio_net_hdr_v1_hash_tunnel without zeroing it. For a non-tunnel skb, virtio_net_hdr_tnl_from_skb() only initializes the first 10 bytes (sizeof(struct virtio_net_hdr)), leaving bytes 10..23 (num_buffers and the hash/tunnel fields) as stack garbage.

An unprivileged user can set the vnet header size to 24 with TUNSETVNETHDRSZ, so __tun_vnet_hdr_put() copies all 24 bytes of the partially-initialized struct to userspace, leaking 14 bytes of kernel stack on every read of a non-tunnel packet.

Fix it the same way tun_get_user() already does by zeroing the whole header right after declaration.

AnalysisAI

Kernel stack memory disclosure in the Linux TUN driver exposes 14 bytes of uninitialized stack data to unprivileged local users on every read of a non-tunnel packet. The flaw affects Linux systems where a local user can open a TUN device and issue the TUNSETVNETHDRSZ ioctl to set the vnet header size to 24 bytes. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), consistent with a local-only information disclosure requiring deliberate TUN device configuration.

Technical ContextAI

The vulnerability resides in tun_put_user() within the Linux kernel TUN/TAP virtual network driver. An on-stack struct virtio_net_hdr_v1_hash_tunnel (24 bytes total) is declared without zero-initialization. For non-tunnel skbs, virtio_net_hdr_tnl_from_skb() initializes only the first 10 bytes (the base struct virtio_net_hdr), leaving bytes 10-23 - the num_buffers field and the hash/tunnel extension fields - as uninitialized kernel stack memory. When an unprivileged process calls TUNSETVNETHDRSZ with value 24 to enable 24-byte vnet headers, __tun_vnet_hdr_put() copies the full 24-byte struct to userspace on each packet read, leaking 14 bytes of kernel stack per read. The root cause is a missing initialization of the on-stack structure, analogous to CWE-909 (Missing Initialization of Resource). The fix mirrors the pattern already used in the sibling function tun_get_user(), which zeroes the header after declaration. CPE data identifies the affected product as cpe:2.3:a:linux:linux.

RemediationAI

Update to a patched kernel version: Linux 7.1, 6.18.36, or 7.0.13 as applicable to your stable series. The upstream fix zeroes the virtio_net_hdr_v1_hash_tunnel struct immediately after declaration in tun_put_user(), mirroring the initialization already present in tun_get_user(). Fix commits are available at https://git.kernel.org/stable/c/5fd1fa5a4254bfdd70571c77f5e3bcb4e43738d5, https://git.kernel.org/stable/c/585cb85e9a29185be05f326369573c2663cf4380, and https://git.kernel.org/stable/c/7f2fcff15e99bb852f6967396ed12b38376e2c8d. Where patching is not immediately feasible, restrict unprivileged access to TUN devices by tightening /dev/net/tun permissions or restricting CAP_NET_ADMIN to trusted processes; this trades off user-space VPN and container networking functionality but removes the ability for unprivileged users to call TUNSETVNETHDRSZ and trigger the leak path.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38710 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy