cyfenced.com →

[ CVE-2026-81000 · Published 11 Sep 2026 ]

Vulnerability in Linux

CVSS 7.8 EPSS <1%5 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Interim mitigation published by PrivacySafe

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.

[ Fixes ]Fixes and patches

  • Linux kernel module blockerInterim mitigation · PrivacySafe · List, check and reversible blocks for The Linux kernel on every distribution: stop any module from loading, with a list of 42 (recent exploits, older well known flaws, rarely needed attack surface), a status command and a rollback
  • Linux kernel local root quartetInterim mitigation · PrivacySafe · Check, opt-in protective measures (`mitigate`) and rollback for The Linux kernel on every distribution: four local privilege escalations with public exploits (IPsec AH6, TUN/TAP, PPPoE, SCTP), each fixed at a different release per branch

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1385

    Multiple vulnerabilities in VMware products Translated from French

    Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

    CVE-2019-25013CVE-2017-9937CVE-2025-6395+4953 more CVEs
  • CERT-FRCERTFR-2026-AVI-1372

    Multiple vulnerabilities in SUSE products Translated from French

    Multiple vulnerabilities have been discovered in SUSE products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

    CVE-2026-72436CVE-2026-74632CVE-2026-89702+616 more CVEs
  • CERT-FRCERTFR-2026-AVI-1375

    Multiple vulnerabilities in the Debian LTS Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Debian LTS Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

    CVE-2026-80967CVE-2026-43198CVE-2026-98532+1377 more CVEs
  • CERT-FRCERTFR-2026-AVI-1335

    Multiple vulnerabilities in the SUSE Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the SUSE Linux kernel. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

    CVE-2026-72436CVE-2026-74632CVE-2026-89702+602 more CVEs
  • CERT-FRCERTFR-2026-AVI-1289

    Multiple vulnerabilities in the Debian LTS Linux kernel Translated from French

    Multiple vulnerabilities have been discovered in the Debian LTS Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

    CVE-2025-38237CVE-2025-39833CVE-2025-39925+1311 more CVEs

[ References ]References