CVE-2026-81000

⚡ CVE-2026-81000 - TUNderflow Linuxカーネル TUN/TAP 受信ヘッドルームのメモリ破壊 TUN/TAPネットワークサブシステム におけるLinuxカーネルのメモリ破壊脆弱性であり、受信ヘッドルームの境界チェック不足とパケット割り当てパスにおける整数アンダーフローによって引き起こされます。 ⚠️ 免責事項 このリポジトリは、許可されたセキュリティ研究、脆弱性分析、CTF環境、カーネルデバッグ、および防御的テストを目的としています。 明示的な許可なく、システムに対して概念実証コードを使用しないでください。 📌 脆弱性の概要 項目| 詳細 ---|---...

CVE-2026-98158

In the Linux kernel, the following vulnerability has been resolved: pppasync: drop the errored frame instead of resetting its headroom pppreceivenonmpframe prepends a two-byte direction tag before running the pass/active BPF filters: be16 skbpushskb, 2 = htonsPPPFILTERINBOUNDTAG; Nothing on the...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-115)

The version of kernel installed on the remote host is prior to 5.15.220-153.253. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2026-115 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom CVE-2026-810...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft CVE-2026-80844 In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom CVE-2026-81000 Affected Packages: kernel Note: Th...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom CVE-2026-81000 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and...

Important: kernel-livepatch-6.18.48-107.148

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft CVE-2026-80844 In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom CVE-2026-81000 Affected Packages:...

CVE-2026-90160

In the Linux kernel, the following vulnerability has been resolved: lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modify the skb head and still return BPFOK, so bpfxmit rechecks the...

DEBIAN-CVE-2026-90160

In the Linux kernel, the following vulnerability has been resolved: lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modify the skb head and still return BPFOK, so bpfxmit rechecks the...

EUVD-2026-81753

In the Linux kernel, the following vulnerability has been resolved: lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modify the skb head and still return BPFOK, so bpfxmit rechecks the...

CVE-2026-90160: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modify the skb head and still return BPFOK, so bpfxmit rechecks the...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: tunnels: Annotations were added for lockless accesses to dev-neededheadroom. IP tunnels can apparently update dev-neededheadroom during their xmit path. This patch addresses issues related to three types of tunnels xmit, ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: Do not assume adequate headroom for SDIO headers The function mt7921usbsdiotxprepareskb calls mt7921usbsdiowritetxwi and mt7921skbaddusbsdiohdr. Both functions blindly assume that adequate headroom will be available...

Linux Distros Unpatched Vulnerability : CVE-2026-81000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an...

Linux Distros Unpatched Vulnerability : CVE-2026-80978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can...

CVE-2026-89563

A flaw was found in the ip6tunnel module of the Linux kernel. Incorrect handling of socket buffers skb during headroom reallocation in the ip6tnlxmit function can lead to a double-free vulnerability. This occurs when an error path is taken after the original skb has been consumed, but the caller...

AZL-100262 CVE-2026-89563 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

DEBIAN-CVE-2026-89563

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

CVE-2026-81000

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

DEBIAN-CVE-2026-81000

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...