Executive brief
The Linux kernel's TUN/TAP network interface allows virtual network devices used in virtualization and containerization. A flaw in how it handles receive buffer alignment can cause a malicious or misconfigured system to place packet data outside the allocated memory region, leading to memory corruption, denial of service, or potential code execution on systems running affected kernel versions.
Technical details
The vulnerability exists in the tun_get_user() function in drivers/net/tun.c, where the tun->align value is used both for socket buffer (skb) headroom allocation and to determine linear packet data length. When align is oversized (propagated via Open vSwitch from another port), SKB_MAX_HEAD(align) underflows and produces a negative value stored in good_linear. This negative value wraps to a large positive when cast to size_t, causing tun_alloc_skb() to place skb->data outside the allocated head buffer. The fix bounds the headroom to safe limits (SKB_MAX_HEAD(0) and U16_MAX-1) and ensures safe header access via pskb_may_pull() checks before dereferencing skb->data. The vulnerability requires local or network-level access to configure headroom values, and affects the TUN/TAP packet processing path.
Affected products
- Linux Linux kernel Versions 2.6.11 through 6.x (prior to patch 447c9303942c439a117d9b76ce6d6e2116b38ee7)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-08-12: patched: Patch 447c9303942c439a117d9b76ce6d6e2116b38ee7 authored and committed to stable trees