CVE-2026-81000

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tun_get_user() function when processing oversized headroom requests. This can occur if Open vSwitch (OVS) propagates an excessively large headroom request to the TUN or TAP device. Successful exploitation could lead to memory corruption, where network packet data is written outside its intended buffer, potentially causing a denial of service or other system instability.

Red Hat rates this vulnerability as Important because an attacker with local access or control over virtualized network traffic can trigger out-of-bounds kernel memory writes, potentially achieving system compromise or causing an immediate kernel panic. In typical enterprise environments, virtual network interfaces such as TUN and TAP are widely leveraged alongside software-defined networking and hypervisors. Although untrusted remote callers cannot directly reach these interfaces on default installations, the risk of kernel memory corruption from unprivileged local contexts or container boundaries justifies this rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

See the security bulletin for a detailed mitigation procedure.