CVE-2026-81000

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the tun get user() function where the tun->align variable is used for both skb headroom and determining the amount of linear packet data. Open vSwitch (OVS) can propagate an oversized headroom request to TUN or TAP. If align exceeds the usable space in a one-page skb head, SKB MAX HEAD(align) underflows, resulting in a negative value stored in good linear. This value subsequently wraps when assigned to the linear variable, allowing tun alloc skb() to place skb->data outside the allocated head.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.