⚠️ Disclaimer

This repository is intended for authorized security research, vulnerability analysis, CTF environments, kernel debugging, and defensive testing.

Do not use proof-of-concept code against systems without explicit authorization.

📌 Vulnerability Overview

The CVE advisory describes the issue as an integer underflow that can cause skb->data to be positioned outside the allocated skb head.

🧬 Vulnerability Description

The vulnerability exists in the Linux kernel's TUN/TAP receive path.

The affected code uses the TUN device's configured receive headroom both as packet headroom and when calculating how much packet data should remain linear.

An oversized headroom value can therefore create an invalid calculation in:

SKB_MAX_HEAD(align)

When the supplied value exceeds the usable one-page skb head, the calculation can underflow.

Conceptually:

Oversized receive headroom
          │
          ▼
     SKB_MAX_HEAD()
          │
          ▼
     Integer underflow
          │
          ▼
    Negative value
          │
          ▼
      size_t wrap
          │
          ▼
Invalid skb data placement
          │
          ▼
Kernel memory corruption

The vulnerable implementation is located in:

drivers/net/tun.c

with tun_get_user() being central to the vulnerable path.

🔬 Root Cause

The underlying problem is insufficiently bounded TUN receive headroom.

The kernel can receive an oversized headroom request through network-device paths that propagate the value to TUN/TAP.

The vulnerability becomes particularly interesting when a complex virtual networking configuration causes a large headroom value to reach a TUN device.

The public disclosure describes a scenario involving:

Netkit
   │
   ▼
VXLAN
   │
   ▼
Open vSwitch
   │
   ▼
TUN

An example configuration can propagate approximately 4160 bytes of headroom to a raw TUN port, causing the vulnerable arithmetic to underflow.

💥 Security Impact

The corruption occurs in kernel networking memory-management logic.

Potential consequences include:

• Kernel memory corruption
• Kernel crash
• Denial of service
• Corruption of kernel structures
• Potential kernel code execution
• Local privilege escalation

The public disclosure reports the vulnerability as one of a group of Linux local-root vulnerabilities and states that the published PoC can achieve unprivileged local user-to-root execution on supported targets.

Exploitability is environment-dependent and requires the relevant TUN/network device configuration and supporting functionality.

🧠 Technical Flow

             ATTACKER
                 │
                 ▼
       Oversized network headroom
                 │
                 ▼
        Virtual network device
                 │
                 ▼
             Open vSwitch
                 │
                 ▼
              TUN/TAP
                 │
                 ▼
          tun_get_user()
                 │
                 ▼
       SKB_MAX_HEAD(align)
                 │
                 ▼
          Integer underflow
                 │
                 ▼
          size_t wraparound
                 │
                 ▼
       Invalid skb->data offset
                 │
                 ▼
       Kernel memory corruption

🔎 Vulnerable Code Path

The important components are:

drivers/net/tun.c
        │
        ├── tun_set_headroom()
        │
        ├── tun_get_user()
        │
        └── tun_alloc_skb()

The vulnerable relationship can be simplified as:

tun->align
    │
    ├── skb headroom
    │
    └── linear-data calculation

Using the same oversized value in both calculations creates an unsafe relationship between the requested headroom and the actual skb head budget.

🧮 Integer Underflow

The critical security property can be represented conceptually as:

usable_head < requested_headroom

which can result in:

SKB_MAX_HEAD(align) < 0

followed by an unsigned conversion:

negative value
      ↓
size_t
      ↓
very large unsigned value

This can ultimately influence skb allocation/data placement.

The official description specifically notes that the resulting value wraps when assigned to the size_t linear variable.

🩹 Upstream Fix

The upstream fix is:

447c9303942c439a117d9b76ce6d6e2116c38ee7

Commit:

net: tun: bound receive headroom

The fix bounds the headroom stored by TUN against the available one-page skb head budget and the largest valid 16-bit skb header offset. It also ensures sufficient linear data is available for raw TUN and TAP processing.

🛡️ Patch Concept

Before

User / network device
        │
        ▼
Large headroom
        │
        ▼
tun->align
        │
        ▼
Unsafe arithmetic
        │
        ▼
Potential OOB access

After

User / network device
        │
        ▼
Large headroom
        │
        ▼
Bounded headroom
        │
        ▼
Safe skb calculation
        │
        ▼
Normal packet processing

📊 Vulnerable vs Patched

🧪 Research Environment

Recommended laboratory topology:

┌─────────────────────────────────────────┐
│             Linux VM / Host             │
│                                         │
│   ┌─────────┐     ┌──────────────┐     │
│   │ Netkit  │────▶│    VXLAN     │     │
│   └─────────┘     └──────┬───────┘     │
│                          │             │
│                   ┌──────▼───────┐     │
│                   │ Open vSwitch │     │
│                   └──────┬───────┘     │
│                          │             │
│                   ┌──────▼───────┐     │
│                   │    TUN/TAP   │     │
│                   └──────────────┘     │
│                                         │
└─────────────────────────────────────────┘

Useful tools:

uname -a
ip link
ip tuntap
bridge link
ovs-vsctl show
dmesg -w

For kernel debugging:

GDB
GDB + GEF
GDB + pwndbg
crash
objdump
readelf
pahole

🔎 Kernel Verification

Check the running kernel:

uname -r

Check kernel configuration:

grep CONFIG_TUN /boot/config-$(uname -r)

Expected configuration:

CONFIG_TUN=y

or:

CONFIG_TUN=m

Check whether the module is loaded:

lsmod | grep tun

🧪 PoC Research

The public disclosure provides a dedicated TUNderflow PoC repository for controlled validation.

For a safe research workflow:

1. Build vulnerable kernel
2. Boot isolated VM
3. Configure TUN/TAP
4. Reproduce oversized headroom
5. Monitor kernel messages
6. Capture crash/corruption behavior
7. Apply upstream patch
8. Repeat test
9. Compare results

Monitor the kernel:

sudo dmesg -w

The goal of the laboratory is to demonstrate the difference between vulnerable and patched behavior rather than attack production systems.

📂 Repository Structure

CVE-2026-81000-TUNderflow/
│
├── README.md
│
├── exploit/
│   ├── poc.c
│   └── Makefile
│
├── analysis/
│   ├── root-cause.md
│   ├── kernel-path.md
│   ├── integer-underflow.md
│   └── patch-analysis.md
│
├── kernel/
│   ├── vulnerable/
│   └── patched/
│
├── lab/
│   ├── setup.sh
│   ├── cleanup.sh
│   └── topology.md
│
├── screenshots/
│
├── docs/
│   └── research-notes.md
│
└── LICENSE

🔐 Mitigation

The recommended mitigation is to install a kernel containing the upstream security fix or an appropriate distribution backport.

For Debian/Kali:

sudo apt update
sudo apt full-upgrade

Then reboot:

sudo reboot

Verify:

uname -r

For production environments, verify the installed distribution kernel against the vendor's security advisory rather than relying solely on the upstream version number.

Oracle Linux, for example, has published security updates containing the net: tun: bound receive headroom fix.

📦 Stable Kernel Fixes

The public disclosure identifies the following stable kernel releases as the first releases containing the fixes for the four disclosed local-root vulnerabilities, including TUNderflow:

🧩 Security Lessons

TUNderflow demonstrates several important kernel-security principles:

01 — Bound externally influenced values

Network configuration values must never be blindly trusted.

02 — Validate arithmetic before allocation

Integer underflow can turn a seemingly harmless calculation into a memory-safety primitive.

03 — Separate metadata from memory assumptions

A network-device headroom value must remain consistent with the actual skb memory budget.

04 — Complex networking stacks increase attack surface

Virtual networking layers can propagate unexpected packet metadata across multiple subsystems.

05 — Patch analysis matters

Studying the upstream fix often provides a clearer understanding of the original vulnerability than looking only at the crash.

📚 References

• CVE: CVE-2026-81000
• Component: Linux Kernel TUN/TAP
• Affected file: drivers/net/tun.c
• Primary function: tun_get_user()
• Upstream fix: 447c9303942c439a117d9b76ce6d6e2116c38ee7
• Fix: net: tun: bound receive headroom
• Disclosure: Linux kernel security advisory / oss-security

👤 Research