CVE-2026-52940

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists where the tun put user() function declares a virtio net hdr v1 hash tunnel structure on the stack without initializing it to zero. For non-tunnel socket buffers (skb), the virtio net hdr tnl from skb() function only initializes the first 10 bytes, leaving the remaining bytes (specifically num buffers and hash/tunnel fields) containing residual stack data. An unprivileged user can utilize TUNSETVNETHDRSZ to set the vnet header size to 24, causing the tun vnet hdr put() function to copy the entire partially-initialized structure to userspace. This results in the leakage of 14 bytes of kernel stack memory during every read of a non-tunnel packet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.