Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 4h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 7h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 7h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 8h Vulnerability in Sparx Systems Enterprise Architect software · 8h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 8h Vulnerabilities in Slican telephone exchanges · 9h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 12h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 13h Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts · 13h Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 4h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 7h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 7h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 8h Vulnerability in Sparx Systems Enterprise Architect software · 8h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 8h Vulnerabilities in Slican telephone exchanges · 9h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 12h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 13h Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts · 13h

ACyber Sentinel Security Assessment Team

← Back to feed

⚠️ Vulnerability Report

CVE-2026-81000

HIGH CVSS 7.8 CVSS 3.1 📌 Received

CVE-2026-81000 - net: tun: bound receive headroom

In the Linux kernel, the following vulnerability has been resolved:

net: tun: bound receive headroom

tun_get_user() uses tun->align both as skb headroom and when choosing how

much packet data to keep linear. OVS can propagate an oversized headroom

request from another port to TUN or TAP.

When align is larger than the usable space in a one-page skb head,

SKB_MAX_HEAD(align) underflows and the result becomes negative when stored

in good_linear. That value later wraps when assigned to the size_t linear

variable, and tun_alloc_skb() can place skb->data outside the allocated

head.

Bound the headroom stored by TUN to the one-page skb-head budget and the

largest non-sentinel 16-bit skb header offset. Leave one linear byte for

raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.

Also pull the raw-TUN protocol byte and the TAP Ethernet header before

accessing them, so these checks remain safe for nonlinear skbs supplied by

other allocation paths.

Published: Sep 11, 2026 20:19

Last Modified: Sep 14, 2026 13:18