CVE-2026-81000

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

CVE-2026-81000

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

CVE-2026-81000

CVE-2026-81000 affects the Linux kernel TUN/TAP network device. The root cause is in tun_get_user(), which uses tun->align as both the skb headroom and the linear-data budget. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align exceeds the usable space i...

EUVD-2026-76323

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

CVE-2026-81000 net: tun: bound receive headroom

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

ligolo-mp

Ligolo-MP : pivoting like a VPN, now with friends! Ligolo-MP is an advanced version of Ligolo-ng, with client-server architecture, enabling pentesters to play with multiple concurrent tunnels collaboratively. It manages all your TUNs automatically, while also providing a clean GUI to track...

rosemary

Rosemary 基于 QUIC 的跨平台内核级内网穿透平台。无需 TUN/TAP。无需 proxychains。无需设置代理。 Rosemary 在远程主机上以内核级透明拦截流量：无需代理设置、无需 TUN/TAP 设备、无需 proxychains。Agent 通过 QUIC 回连服务器。你可以像直接接入远程网络一样访问整个远端网络。 目录 工作原理 功能特性 支持平台 截图 快速开始 PowerShell 代理 发布说明 CLI 参考 API 构建 安全 许可证 作者 工作原理 在你的机器上运行服务端 ，并在任意远程主机上部署Agent 。Agent 通过 QUIC 回连，服务端为...

wifitap

wifitap.py --- 通过 tun/tap 设备实现 WiFi 注入工具 Cedric Blancher [email protected] http://sid.rstack.org/index.php/Wifitap 法文 http://sid.rstack.org/index.php/WifitapEN 英文 本程序是一个概念验证工具，允许通过流量注入进行 WiFi 通信。 你需要： root@kitploit: . Python = 2.2 . Psyco Python 优化器（可选） . Philippe Biondi 的 Scapy . 支持注入的无线适配器...

ligolo-ng

Ligolo-ng : VPNのようにトンネリング TUNインターフェースを使用する、高度でありながらシンプルなトンネリングツール。 📑 Ligolo-ng ドキュメント セットアップ/クイックスタート !TIP Ligolo-ng 0.8 では多くの新機能が追加されました。以下を含みます: 🌐 API と L'ami du Raisin による美しい Web インターフェースにより、マルチプレイヤー が可能に！ ⚙️ シンプルな設定ファイルでトンネリング/プロキシ設定を保持 🚦 デーモンモード で Ligolo-ng をサービスとして実行 🔗...

PT-2026-90130

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun get user uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align ...

The vulnerability of the tun_xdp_one() function in the drivers/net/tun.c module of the Linux kernel’s network device driver allows a attacker to cause a service failure.

The vulnerability of the tunxdpone function in the drivers/net/tun.c file of the Linux kernel’s network device driver leads to an infinite loop when a condition for exiting the loop is not met. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the tun_xdp_one() function in the drivers/net/tun.c module of the Linux kernel’s network device driver allows a attacker to cause a service failure.

The vulnerability of the tunxdpone function in the drivers/net/tun.c file of the Linux kernel’s network device driver module is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the tunPutUser() function in the drivers/net/tun.c file of the Linux kernel’s network device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tunPutUser function in the drivers/net/tun.c file of the Linux kernel network device driver is related to the lack of resource initialization. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2026-80590 inet: frags: strip GSO state from fragments before reassembly

In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...

Linux Distros Unpatched Vulnerability : CVE-2026-80590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO;...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Net: tun: Unlinking the NAPI from the device upon destruction. Syzbot identified a race condition between the tun file and the device destruction process. NAPIs reside in the structtunfile structure, and this structure may be...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: can: afcan: fixed NULL pointer dereferencing in canrcvfilter. Similar to the issue reported in commit 8aa59e355949 “can: afcan: fixed NULL pointer dereferencing in canrxregister”, we need to check for a missing initialization ...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Networking layer: Fixed a memory leak that occurred when uncloning an skb dst and its associated metadata. When uncloning an skb dst and its associated metadata, a new dst+metadata is allocated and later replaces the old one in t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhostworker will call tun call backs to receive packets. If too many illegal packets arrives, tundoread will keep dumping packet contents. When console is enabled, ...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: core: The unnecessary framesz check in bpfxdpadjusttail has been removed. Syzkaller reported the following issue: ======================================= “Too big” – xdp-framesz = 131072 WARNING: CPU: 0, PID: 5020, at...