# CVE-2026-99281: Linux kernel tun device CAP_NET_ADMIN permission check

Source: https://junglewise.ai/threats/cve-2026-99281-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-99281 · Severity: info · Published 2026-11-07

The Linux kernel's TUN/TAP virtual network device driver previously allowed any user to attach to persistent devices with no assigned owner or group, bypassing the capability check that was supposed to protect such operations. This vulnerability enables unauthorized network device access and packet manipulation without elevated privileges. The fix requires the CAP_NET_ADMIN capability for users to attach to ownerless TUN/TAP devices.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-99281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-99281 being exploited in the wild.

**How severe is CVE-2026-99281?** Informational severity, published 7 November 2026.

**Which products and versions are affected?** Linux Kernel prior to fix (2026-11-07).

**Is there a fix for CVE-2026-99281?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-99281 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-99281?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The TUN/TAP device driver had a privilege escalation flaw where persistent devices without an explicit owner or group assignment could be attached to by any user who could open /dev/net/tun, despite prior fixes attempting to enforce CAP_NET_ADMIN checks. The vulnerability stems from a 2024 attempted fix that was reverted due to a false compatibility concern with SELinux test expectations. The fix now properly enforces that attachment to an ownerless device requires either matching user/group ownership or CAP_NET_ADMIN capability.

## Affected products

- Linux Linux kernel prior to fix (2026-11-07)

## Timeline

- 2026-11-07: advisory

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)