0xblackash/cve-2026-81000Research repository for CVE-2026-81000 (TUNderflow), a Linux kernel TUN/TAP receive headroom integer underflow enabling local privilege escalation, with PoC, root-cause analysis, and lab setup.
TUNderflow
A Linux kernel memory-corruption vulnerability in the TUN/TAP networking subsystem, caused by insufficient bounds on receive headroom and an integer underflow in the packet allocation path.
This repository is intended for authorized security research, vulnerability analysis, CTF environments, kernel debugging, and defensive testing.
Do not use proof-of-concept code against systems without explicit authorization.
| Field | Details |
|---|---|
| CVE | CVE-2026-81000 |
| Codename | TUNderflow |
| Component | Linux Kernel |
| Subsystem | TUN/TAP |
| Affected Code | drivers/net/tun.c |
| Primary Function | tun_get_user() |
| Bug Class | Integer underflow / out-of-bounds memory access |
| Impact | Kernel memory corruption |
| Potential Impact | Local privilege escalation |
| CVSS v3.1 | 7.8 — High |
| Attack Vector | Local |
| Privileges Required | Low |
| User Interaction | None |
| Status | Patched |
The CVE advisory describes the issue as an integer underflow that can cause
skb->data to be positioned outside the allocated skb head.
The vulnerability exists in the Linux kernel's TUN/TAP receive path.
The affected code uses the TUN device's configured receive headroom both as packet headroom and when calculating how much packet data should remain linear.
An oversized headroom value can therefore create an invalid calculation in:
SKB_MAX_HEAD(align)
When the supplied value exceeds the usable one-page skb head, the calculation can underflow.
Conceptually:
Oversized receive headroom
│
▼
SKB_MAX_HEAD()
│
▼
Integer underflow
│
▼
Negative value
│
▼
size_t wrap
│
▼
Invalid skb data placement
│
▼
Kernel memory corruption
The vulnerable implementation is located in:
drivers/net/tun.c
with tun_get_user() being central to the vulnerable path.
The underlying problem is insufficiently bounded TUN receive headroom.
The kernel can receive an oversized headroom request through network-device paths that propagate the value to TUN/TAP.
The vulnerability becomes particularly interesting when a complex virtual networking configuration causes a large headroom value to reach a TUN device.
The public disclosure describes a scenario involving:
Netkit
│
▼
VXLAN
│
▼
Open vSwitch
│
▼
TUN
An example configuration can propagate approximately 4160 bytes of headroom to a raw TUN port, causing the vulnerable arithmetic to underflow.
The corruption occurs in kernel networking memory-management logic.
Potential consequences include:
The public disclosure reports the vulnerability as one of a group of Linux local-root vulnerabilities and states that the published PoC can achieve unprivileged local user-to-root execution on supported targets.
Exploitability is environment-dependent and requires the relevant TUN/network device configuration and supporting functionality.
ATTACKER
│
▼
Oversized network headroom
│
▼
Virtual network device
│
▼
Open vSwitch
│
▼
TUN/TAP
│
▼
tun_get_user()
│
▼
SKB_MAX_HEAD(align)
│
▼
Integer underflow
│
▼
size_t wraparound
│
▼
Invalid skb->data offset
│
▼
Kernel memory corruption
The important components are:
drivers/net/tun.c
│
├── tun_set_headroom()
│
├── tun_get_user()
│
└── tun_alloc_skb()
The vulnerable relationship can be simplified as:
tun->align
│
├── skb headroom
│
└── linear-data calculation
Using the same oversized value in both calculations creates an unsafe relationship between the requested headroom and the actual skb head budget.
The critical security property can be represented conceptually as:
usable_head < requested_headroom
which can result in:
SKB_MAX_HEAD(align) < 0
followed by an unsigned conversion:
negative value
↓
size_t
↓
very large unsigned value
This can ultimately influence skb allocation/data placement.
The official description specifically notes that the resulting value wraps when
assigned to the size_t linear variable.
The upstream fix is:
447c9303942c439a117d9b76ce6d6e2116c38ee7
Commit:
net: tun: bound receive headroom
The fix bounds the headroom stored by TUN against the available one-page skb head budget and the largest valid 16-bit skb header offset. It also ensures sufficient linear data is available for raw TUN and TAP processing.
User / network device
│
▼
Large headroom
│
▼
tun->align
│
▼
Unsafe arithmetic
│
▼
Potential OOB access
User / network device
│
▼
Large headroom
│
▼
Bounded headroom
│
▼
Safe skb calculation
│
▼
Normal packet processing