In the Linux kernel, the following vulnerability has been resolved:
net: tun: bound receive headroom
tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP.
When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head.
Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.
Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-headersUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-docUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-zfcpdumpUpgrade kernel-64k-coreUpgrade kernel-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-debugUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modules-coreUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-modulesUpgrade perfUpgrade kernel-rt-debugUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-64kUpgrade kernel-64k-debugUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-cross-headersUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-64k-modules-extraUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-develUpgrade kernelUpgrade bpftool | Oct 11, 2026 | Sep 23, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-modules-extra-commonUpgrade kernel-livepatch-6.1.186-228.376Upgrade kernel-livepatch-6.18.48-109.150Upgrade bpftool-debuginfoUpgrade kernel-tools-develUpgrade kernel6.18-headersUpgrade kernel6.12-modules-extraUpgrade bpftool6.18-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade python3-perf6.12Upgrade kernel6.12-tools-develUpgrade bpftool6.12Upgrade python3-perf6.18-debuginfoUpgrade bpftool6.12-debuginfoUpgrade perf6.18-debuginfoUpgrade perfUpgrade kernel6.12Upgrade perf-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.18-debuginfoUpgrade python3-perfUpgrade kernel6.18-toolsUpgrade kernel-toolsUpgrade bpftool6.18Upgrade kernel6.18-tools-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel6.18-develUpgrade kernel6.12-tools-debuginfoUpgrade bpftoolUpgrade perf6.12Upgrade kernel6.12-develUpgrade kernel6.12-headersUpgrade kernel-develUpgrade kernel6.18-modules-extraUpgrade kernel6.18-tools-develUpgrade kernel-livepatch-6.12.103-129.197Upgrade python3-perf6.18Upgrade microvm-kernel6.18Upgrade kernel6.18-modules-extra-commonUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-toolsUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade perf6.18Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18Upgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-x86_64 | Sep 30, 2026 | Sep 11, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Sep 30, 2026 | Sep 11, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Oct 7, 2026 | Sep 11, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Sep 15, 2026 | Sep 11, 2026 |
| Rocky_linux | — | Upgrade kernel-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-debuginfo-common-s390xUpgrade rvUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-toolsUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debug-modulesUpgrade python3-perfUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debugUpgrade libperf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernelUpgrade kernel-tools-libs-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-uki-virtUpgrade kernel-debug-modules-coreUpgrade kernel-debug-coreUpgrade perfUpgrade kernel-rt-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade libperfUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdumpUpgrade kernel-uki-virtUpgrade kernel-rt-coreUpgrade kernel-devel-matchedUpgrade perf-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-debug-develUpgrade rtlaUpgrade kernel-rt-debuginfoUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-core | Sep 28, 2026 | Sep 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 21, 2026 | Sep 11, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub