CVE-2026-81000 — Linux Vulnerability Details

What is CVE-2026-81000?

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.

Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 42 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 7.8 — HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (FIRST): 0.3% probability of exploitation in the next 30 days, higher than 27.4% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 7/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2026-09-11, last modified 2026-09-14

Is CVE-2026-81000 being exploited?

Weaponised exploit code for CVE-2026-81000 is publicly available. 3 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 43 in the Threadlinqs vulnerability feed.

Affected products and versions

Linux: Linux

How to fix CVE-2026-81000

No vendor patch reference has been recorded for CVE-2026-81000 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-81000

1 tracked threat in the Threadlinqs corpus references CVE-2026-81000, either in the campaign’s CVE list or as an indicator on the campaign record.

"LPE Quartet": Public Exploits Released for Four Linux Kernel Local-Root Flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) — HIGH · 2026-09-18

Sources

Enriched from CVE.org, FIRST EPSS, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10.

Other references

Showing 5 of 8 recorded references.