Description
In the Linux kernel, the following vulnerability has been resolved:
net: tun: bound receive headroom
tun_get_user() uses tun->align both as skb headroom and when choosing how
much packet data to keep linear. OVS can propagate an oversized headroom
request from another port to TUN or TAP.
When align is larger than the usable space in a one-page skb head,
SKB_MAX_HEAD(align) underflows and the result becomes negative when stored
in good_linear. That value later wraps when assigned to the size_t linear
variable, and tun_alloc_skb() can place skb->data outside the allocated
head.
Bound the headroom stored by TUN to the one-page skb-head budget and the
largest non-sentinel 16-bit skb header offset. Leave one linear byte for
raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.
Also pull the raw-TUN protocol byte and the TAP Ethernet header before
accessing them, so these checks remain safe for nonlinear skbs supplied by
other allocation paths.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 4.6 | 5.10.270 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.2.6-1 | — |
| Debian 13 | linux | 6.12.111-1 | — |
| Debian 12 | linux | 6.1.190-1 | — |
| Debian 12 | linux-6.12 | 6.12.111-1~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1036.41 | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1103.105 | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-42.42 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-aws | 7.0.0-1016.17 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1020.21 | USN-9019-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1019.19 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-gcp | 7.0.0-1016.18 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1010.11 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1017.17 | USN-8960-1, USN-8959-1 |
| Ubuntu 26.04 LTS | linux-nvidia +1 | No fix yet | — |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1015.16 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-realtime | 7.0.0-43.43.1 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-riscv | 7.0.0-42.42.1 | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-149.149 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1069.74 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-aws-7.0 | 7.0.0-1017.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1073.82 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1071.78 | USN-9039-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1019.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1073.81 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-gcp-7.0 | 7.0.0-1017.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1068.77 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1053.57 | USN-9023-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-42.42~24.04.1 | USN-8959-1 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1069.70 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-149.149.1 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1067.70 | USN-9024-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1067.70.1 | USN-9040-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1038.42 | USN-9002-1 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1067.71 | USN-9022-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1016.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1068.72 | USN-9025-1 |
| Ubuntu 24.04 LTS | linux-riscv +31 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-42.42.1~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-vmware | 6.8.0-1010.10 | USN-9022-1 |
| Ubuntu 22.04 LTS | linux | 5.15.0-202.212 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1119.126 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1069.74~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1125.134 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1073.82~22.04.1 | USN-9026-1 |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1124.133 | USN-8962-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1071.78~22.04.1 | USN-9026-1 |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1120.130 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1073.81~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1115.121 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1102.110 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-149.149~22.04.1 | USN-9066-1 |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1113.117 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1069.70~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1114.120 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1111.116 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-lowlatency | 5.15.0-197.207 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-149.149.1~22.04.1 | USN-9024-1 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1114.115 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1070.72 | USN-8963-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1059.59 | USN-8963-1 |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1116.122 | USN-8961-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1067.71~22.04.1 | USN-9025-1 |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1113.116 | USN-9029-1 |
| Ubuntu 22.04 LTS | linux-riscv +34 | No fix yet | — |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2056.58 | USN-9025-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1064.65 | USN-9023-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1111.115 | USN-8961-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1118.127 | USN-8961-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1064.65~22.04.1 | USN-9024-1 |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1069.74+fips1 | USN-9023-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-azure-fips | 6.8.0-1073.82+fips1 | USN-9022-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips | 6.8.0-1073.81+fips1 | USN-9023-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1119.126+fips1 | USN-8961-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-azure-fips | 5.15.0-1125.134+fips1 | USN-8961-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-202.212+fips1 | USN-8961-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1120.130+fips1 | USN-8961-1 |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux +10 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux-aws-5.15 | 5.15.0-1119.126~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-azure-5.15 | 5.15.0-1125.134~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-azure-fde-5.15 | 5.15.0-1124.133~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-gcp-5.15 | 5.15.0-1120.130~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-hwe-5.15 | 5.15.0-202.212~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-ibm-5.15 | 5.15.0-1113.117~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1114.120~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-lowlatency-hwe-5.15 | 5.15.0-197.207~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1070.72~20.04.1 | USN-8963-1 |
| Ubuntu Pro 20.04 LTS | linux-oracle-5.15 | 5.15.0-1116.122~20.04.1 | USN-8961-1 |
| Ubuntu Pro 20.04 LTS | linux-riscv-5.15 | 5.15.0-1113.117~20.04.2 | — |
| Ubuntu Pro 18.04 LTS | linux +12 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux-gcp +4 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-azure | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +76 | 6.12.0-211.59.1.el10_2 | RHSA-2026:98608, RHSA-2026:71233 |
| RHEL 9 | kpatch-patch-5_14_0-687_10_1 | 1-12.el9_8 | RHSA-2026:96093 |
| RHEL 9 | kpatch-patch-5_14_0-687_42_1 | 1-3.el9_8 | RHSA-2026:96093 |
| RHEL 9 | rv +75 | 5.14.0-687.51.1.el9_8 | RHSA-2026:71232 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.167.1.rt7.508.el8_10 | RHSA-2026:71016 |
| RHEL 8 | kpatch-patch-4_18_0-553_109_1 | 1-15.el8_10 | RHSA-2026:95587 |
| RHEL 8 | kpatch-patch-4_18_0-553_125_1 | 1-12.el8_10 | RHSA-2026:95587 |
| RHEL 8 | kpatch-patch-4_18_0-553_158_1 | 1-4.el8_10 | RHSA-2026:95587 |
| RHEL 8 | kpatch-patch-4_18_0-553_72_1 | 1-19.el8_10 | RHSA-2026:95587 |
| RHEL 8 | kpatch-patch-4_18_0-553_85_1 | 1-17.el8_10 | RHSA-2026:95587 |
| RHEL 8 | perf +26 | 4.18.0-553.167.1.el8_10 | RHSA-2026:71213 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Rt Els 7 | kernel-rt +7 | 3.10.0-1160.164.1.rt56.1316.el7 | RHSA-2026:71657 |
| RHEL 10.2 EUS | kpatch-patch-6_12_0-211_16_1 | 2-12.el10_2 | RHSA-2026:99722 |
| RHEL 10.2 EUS | kpatch-patch-6_12_0-211_49_1 | 2-4.el10_2 | RHSA-2026:99722 |
| RHEL 10.0 EUS | rv +77 | 6.12.0-55.107.1.el10_0 | RHSA-2026:71599 |
| RHEL 9.6 EUS | kpatch-patch-5_14_0-570_116_1 | 1-13.el9_6 | RHSA-2026:96091 |
| RHEL 9.6 EUS | kpatch-patch-5_14_0-570_135_1 | 1-4.el9_6 | RHSA-2026:96091 |
| RHEL 9.6 EUS | kpatch-patch-5_14_0-570_39_1 | 1-19.el9_6 | RHSA-2026:96091 |
| RHEL 9.6 EUS | kpatch-patch-5_14_0-570_66_1 | 1-18.el9_6 | RHSA-2026:96091 |
| RHEL 9.6 EUS | kpatch-patch-5_14_0-570_94_1 | 1-16.el9_6 | RHSA-2026:96091 |
| RHEL 9.6 EUS | rv +77 | 5.14.0-570.144.1.el9_6 | RHSA-2026:71631 |
| RHEL 9.4 E4S | bpftool | 7.3.0-427.152.1.el9_4 | RHSA-2026:71569 |
| RHEL 9.4 E4S | kpatch-patch-5_14_0-427_100_1 | 1-18.el9_4 | RHSA-2026:96090 |
| RHEL 9.4 E4S | kpatch-patch-5_14_0-427_113_1 | 1-16.el9_4 | RHSA-2026:96090 |
| RHEL 9.4 E4S | kpatch-patch-5_14_0-427_126_1 | 1-13.el9_4 | RHSA-2026:96090 |
| RHEL 9.4 E4S | kpatch-patch-5_14_0-427_146_1 | 1-4.el9_4 | RHSA-2026:96090 |
| RHEL 9.4 E4S | kpatch-patch-5_14_0-427_84_1 | 1-20.el9_4 | RHSA-2026:96090 |
| RHEL 9.4 E4S | rv +62 | 5.14.0-427.152.1.el9_4 | RHSA-2026:71569 |
| RHEL 9.2 E4S | bpftool | 7.0.0-284.194.1.el9_2 | RHSA-2026:71601 |
| RHEL 9.2 E4S | kernel-rt +14 | 5.14.0-284.194.1.rt14.479.el9_2 | RHSA-2026:71606 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_134_1 | 1-19.el9_2 | RHSA-2026:95600 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_148_1 | 1-17.el9_2 | RHSA-2026:95600 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_158_1 | 1-15.el9_2 | RHSA-2026:95600 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_172_1 | 1-12.el9_2 | RHSA-2026:95600 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_188_1 | 1-4.el9_2 | RHSA-2026:95600 |
| RHEL 9.2 E4S | perf +47 | 5.14.0-284.194.1.el9_2 | RHSA-2026:71601 |
| RHEL 8.8 TUS | perf +17 | 4.18.0-477.170.1.el8_8 | RHSA-2026:71594 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_107_1 | 1-18.el8_8 | RHSA-2026:95601 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_120_1 | 1-17.el8_8 | RHSA-2026:95601 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_130_1 | 1-15.el8_8 | RHSA-2026:95601 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_143_1 | 1-11.el8_8 | RHSA-2026:95601 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_161_1 | 1-4.el8_8 | RHSA-2026:95601 |
| RHEL 8.8 E4S | perf +18 | 4.18.0-477.170.1.el8_8 | RHSA-2026:71594 |
| RHEL 8.6 EUS Long Life | perf +25 | 4.18.0-372.218.1.el8_6 | RHSA-2026:71592 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.218.1.el8_6 | RHSA-2026:71592 |
| RHEL 8.4 EUS Long Life | perf +25 | 4.18.0-305.209.1.el8_4 | RHSA-2026:71565 |
| RHEL 8.4 AUS | perf +17 | 4.18.0-305.209.1.el8_4 | RHSA-2026:71565 |
| RHEL 7 ELS | perf +18 | 3.10.0-1160.164.1.el7 | RHSA-2026:71687 |
| Red Hat Enterprise Linux Nvidia 10 | rv +41 | 6.12.0-259.27.el10nv | RHSA-2026:73788 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | perf +13 | 6.12.0-211.59.1.el10_2 | ALSA-2026:71233 |
| AlmaLinux 9 | kernel +16 | 5.14.0-687.51.1.el9_8 | ALSA-2026:71232 |
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.167.1.rt7.508.el8_10 | ALSA-2026:71016 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.167.1.el8_10 | ALSA-2026:71213 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | kernel | 5.14.0-687.51.1.el9_8 | RLSA-2026:71232 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +7 | 6.4.0-150700.53.84.1 | SUSE-SU-2026:4706-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.84.1.150700.17.47.1 | SUSE-SU-2026:4706-1 |
| SLES 15 SP6 | kernel-64kb +6 | 6.4.0-150600.23.138.1 | SUSE-SU-2026:4660-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.138.1.150600.12.64.1 | SUSE-SU-2026:4660-1 |
| SLES 15 SP5 | kernel-64kb +4 | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.192.2.150500.6.89.2 | SUSE-SU-2026:4667-1 |
| SLES 15 SP5 | kernel-docs +1 | 5.14.21-150500.55.192.1 | SUSE-SU-2026:4667-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.333.2 | SUSE-SU-2026:4687-1 |
Show 19 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.39.1.160000.2.26 | SUSE-SU-2026:24235-1 |
| SLES for SAP 15 SP6 | kernel-default-base | 6.4.0-150600.23.138.1.150600.12.64.1 | SUSE-SU-2026:4660-1 |
| SLES for SAP 15 SP6 | kernel-docs +4 | 6.4.0-150600.23.138.1 | SUSE-SU-2026:4660-1 |
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.192.2.150500.6.89.2 | SUSE-SU-2026:4667-1 |
| SLES for SAP 15 SP5 | kernel-docs +1 | 5.14.21-150500.55.192.1 | SUSE-SU-2026:4667-1 |
| SLES for SAP 15 SP5 | kernel-source +2 | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.39.1 | SUSE-SU-2026:24235-1, SUSE-SU-2026:24197-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.39.1.160000.2.26 | SUSE-SU-2026:24235-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.39.1.160000.2.26 | SUSE-SU-2026:24184-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.39.1 | SUSE-SU-2026:24184-1, SUSE-SU-2026:24179-1 |
| SLE Micro 6.2 | podman | 5.4.2-160000.6.1 | SUSE-SU-2026:24182-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-159998.53.1.159998.21.38 | SUSE-SU-2026:24181-1 |
| SLE Micro 6.1 | kernel-rt +4 | 6.4.0-159998.53.1 | SUSE-SU-2026:24182-1, SUSE-SU-2026:24181-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-159998.53.1.159998.21.38 | SUSE-SU-2026:24315-1 |
| SLE Micro 6.0 | kernel-rt +4 | 6.4.0-159998.53.1 | SUSE-SU-2026:24316-1, SUSE-SU-2026:24315-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.192.2.150500.6.89.2 | SUSE-SU-2026:4667-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.164.1 | SUSE-SU-2026:4665-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.189.1 | SUSE-SU-2026:4666-1 |
| SLE Micro 5.4 | kernel-source +1 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.189.1 | SUSE-SU-2026:4666-1 |
| SLE Micro 5.3 | kernel-source +1 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.84.1 | SUSE-SU-2026:4706-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_21 | 1-150700.1.3.1 | SUSE-SU-2026:4640-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_22 | 1-150700.15.3.1 | SUSE-SU-2026:4706-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.138.1 | SUSE-SU-2026:4660-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_32 | 1-150600.13.3.1 | SUSE-SU-2026:4660-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_46 | 1-150500.11.3.2 | SUSE-SU-2026:4667-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_60 | 1-150400.9.3.1 | SUSE-SU-2026:4668-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.333.2 | SUSE-SU-2026:4687-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_88 | 1-8.3.3 | SUSE-SU-2026:4687-1 |
| SLE HPC 15 SP5 | kernel-64kb +3 | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.192.2.150500.6.89.2 | SUSE-SU-2026:4667-1 |
| SLE HPC 15 SP5 | kernel-docs +1 | 5.14.21-150500.55.192.1 | SUSE-SU-2026:4667-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +2 | 6.4.0-150700.7.78.1 | SUSE-SU-2026:4640-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.2.6-1.1 | openSUSE-SU-2026:11805-1 |
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.39.1.160000.2.25 | openSUSE-SU-2026:22091-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.39.1 | openSUSE-SU-2026:22091-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.1.186-228.376 +2 | 1:1.0-0.amzn2023 | ALAS2023-2026-3104, ALAS2023-2026-3103, ALAS2023-2026-3102 |
| Amazon Linux 2023 | perf +11 | 1:6.1.186-228.376.amzn2023 | ALAS2023-2026-3104 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.103-129.197.amzn2023 | ALAS2023-2026-3103 |
| Amazon Linux 2023 | perf6.18 +12 | 1:6.18.48-109.150.amzn2023 | ALAS2023-2026-3102 |
| Amazon Linux 2 | kernel-livepatch-4.14.355-284.746 | 1.0-0.amzn2 | ALAS2-2026-3929 |
| Amazon Linux 2 | perf +8 | 4.14.355-284.746.amzn2 | ALAS2-2026-3929 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.157.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rv +29 | 6.12.0-211.60.1.el10_2 | ELSA-2026-71233 |
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-206.104.4.4.el10uek | ELSA-2026-500374, ELSA-2026-500328 |
| Oracle Linux 9 | rv +28 | 5.14.0-687.51.1.el9_8 | ELSA-2026-71232 |
| Oracle Linux 8 | kernel-uek +17 | 5.15.0-324.217.5.3.el9uek | ELSA-2026-500329 |
| Oracle Linux 8 | perf +19 | 4.18.0-553.168.1.el8_10 | ELSA-2026-500329, ELSA-2026-71213 |
| Oracle Linux 7 | kernel-uek +6 | 5.4.17-2136.359.3.2.el8uek | ELSA-2026-500375, ELSA-2026-500330 |
| Oracle Linux 7 | kernel-uek-tools | 5.4.17-2136.359.3.2.el7uek | ELSA-2026-500375, ELSA-2026-500330 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 3 repositories
-
HORKimhab/CVE-2026-81000 ★ 0 · Sep 21, 2026
CVE-2026-81000
-
ashrafzaryouh/CVE-2026-81000 ★ 0 · Sep 19, 2026
CVE-2026-81000
-
suominen/tunderflow ★ 0 · Sep 18, 2026
Tracking TUNderflow (CVE-2026-81000), the Linux kernel TUN/TAP receive-headroom underflow
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 50
- RHSA-2026:98608 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 14, 2026
- USN-8961-1 linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-5.15, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9020-1 linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8959-1 linux, linux-aws, linux-gcp, linux-hwe-7.0, linux-ibm, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9022-1 linux, linux-aws, linux-azure, linux-azure-fips, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oracle, linux-vmware vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8963-1 linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9025-1 linux-oracle-6.8, linux-raspi, linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9024-1 linux-aws-6.8, linux-gcp-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia, linux-realtime-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9023-1 linux-aws-fips, linux-gcp-fips, linux-gkeop, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9026-1 linux-azure-6.8, linux-azure-fde-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9039-1 linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9029-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9040-1 linux-nvidia-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9066-1 linux-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9019-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8960-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-9002-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- USN-8962-1 linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 13, 2026
- RHSA-2026:99722 Red Hat Security Advisory: kpatch-patch-6_12_0-211_16_1 and kpatch-patch-6_12_0-211_49_1 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96090 Red Hat Security Advisory: kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_146_1, and kpatch-patch-5_14_0-427_84_1 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96093 Red Hat Security Advisory: kpatch-patch-5_14_0-687_10_1 and kpatch-patch-5_14_0-687_42_1 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96091 Red Hat Security Advisory: kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_135_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95601 Red Hat Security Advisory: kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_161_1 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95587 Red Hat Security Advisory: kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_125_1, kpatch-patch-4_18_0-553_158_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:71213 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:71232 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:71233 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:71016 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95600 Red Hat Security Advisory: kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, kpatch-patch-5_14_0-284_172_1, and kpatch-patch-5_14_0-284_188_1 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3321 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:71232 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:71233 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:71213 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:71016 Important: kernel-rt security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- SUSE-SU-2026:24315-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24316-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24235-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:24197-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:24184-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 20, 2026
- SUSE-SU-2026:24181-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 20, 2026
- SUSE-SU-2026:24182-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 20, 2026
- SUSE-SU-2026:24179-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 20, 2026
- openSUSE-SU-2026:22091-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 19, 2026
- SUSE-SU-2026:4706-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 17, 2026
- SUSE-SU-2026:4666-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 16, 2026
- SUSE-SU-2026:4667-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 16, 2026
- SUSE-SU-2026:4687-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 16, 2026
- RHSA-2026:73788 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:71687 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
References
- https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491
- https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60
- https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76
- https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43
- https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d
- https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2
- https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28
- https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7