EUVD-2026-76323
GHSA-32hf-vhcc-85c2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local exploitation requires low-privilege TUN/TAP device access via network namespace; kernel out-of-bounds write yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: tun: bound receive headroom
tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP.
When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head.
Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.
Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.
AnalysisAI
Memory corruption in the Linux kernel TUN/TAP driver allows a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges to root. The flaw exists in tun_get_user(), where an oversized headroom alignment value - most realistically propagated from Open vSwitch to a TUN or TAP device - causes an integer underflow in SKB_MAX_HEAD(align), producing a negative good_linear value that wraps to a massive size_t, causing tun_alloc_skb() to position skb->data outside the allocated skb head. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access with low privileges sufficient to open or influence a TUN or TAP device, typically requiring CAP_NET_ADMIN within a user network namespace or an equivalent grant. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local exploitation requirement and full-kernel-compromise impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel version: 6.12.109 or later for the 6.12 LTS branch, 6.18.50 or later for the 6.18 stable branch, or 7.2.4 or later for the 7.2 branch; mainline users should track 7.3-rc1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems with active TUN/TAP drivers-check kernel module status and network interfaces on cloud instances, container hosts, and virtualization servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today