In the Linux kernel

CVE-2026-81000, nicknamed TUNderflow, is an integer-underflow flaw in the Linux kernel's TUN/TAP virtual networking subsystem (drivers/net/tun.c). The function tun_get_user() reuses tun->align both as skb headroom and as the linear-data budget. When Open vSwitch (or any stacked device) propagates an oversized headroom request, SKB_MAX_HEAD(align) underflows, turning good_linear negative. That value wraps when cast to size_t, and tun_alloc_skb() places skb->data outside the allocated head — giving an attacker a kernel out-of-bounds write primitive. The bug was introduced in kernel 4.6 (commit eaea34b, circa 2016) and affects every unpatched kernel through 7.2.3. Fixes landed in stable branches 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.

The vendor CVSS of 7.8 HIGH is reasonable for the raw primitive — full C/I/A at local scope. Ubuntu downgraded to Medium priority, likely weighting the local-only attack vector. noisgate keeps this at HIGH 7.0: the local-access requirement is real friction, but TUN/TAP is *the* networking plumbing for containers and virtual machines, meaning the highest-value deployment roles (Kubernetes nodes, KVM hypervisors, CI runners) are exactly where TUN is most active. A public PoC exists. The vendor severity is directionally correct; we shave the score slightly for the local-only, namespace-dependent chain but do not drop the bucket.

Why this verdict

• Public PoC with LPE primitive: A working proof-of-concept exists that converts the integer underflow into a kernel OOB write → root. While distro-specific tuning is needed, the primitive is sound and the technique (heap spray via msg_msg/pipe_buffer) is well-understood in the exploit-dev community.
• Role multiplier — container and virtualization hosts: TUN/TAP is not an optional module; it is *the* virtual networking layer for Docker, Kubernetes, and KVM. On a Kubernetes node, this chain is: container workload (low-priv shell) → user namespace → TUN underflow → kernel code exec → container escape → full node compromise. ≥30% of the installed base of Linux servers running containers have TUN as an active, attacker-reachable component. The blast radius on these hosts is node-level, potentially cluster-level with lateral movement. This floors the verdict at HIGH.
• Local-only vector is meaningful friction: AV:L means the attacker must already have a foothold. This is not a drive-by or network worm. Every exploitation scenario presupposes a prior compromise stage, which compounds the difficulty. This prevents upgrading to CRITICAL.
• Namespace dependency narrows the population: RHEL and SLES restrict unprivileged user namespaces by default. Ubuntu, Fedora, and Debian enable them. Roughly 50-60% of enterprise Linux deployments (Ubuntu/Debian-heavy cloud fleets) are in the permissive default; the remainder require explicit enablement or a different attack path.
• No active exploitation or KEV listing: EPSS is 0.164%. No campaigns observed. The PoC is public but tuned, not weaponized at scale. This argues against emergency treatment but does not reduce the underlying severity of the primitive.

Why not higher?

CRITICAL would require either active exploitation, a remote attack vector, or a wormable chain. CVE-2026-81000 is strictly local (AV:L), has no confirmed in-the-wild abuse, and the PoC requires per-distro tuning. The scope is Unchanged (S:U) — it does not inherently chain across trust boundaries without a prior foothold. Container escape is possible but starts from an already-compromised workload, not from the network.

Why not lower?

MEDIUM would undercount the blast radius on container infrastructure. TUN/TAP is not a niche module — it is foundational to container networking, meaning Kubernetes nodes and KVM hypervisors are canonical targets where the chain succeeds. A public PoC exists with a proven kernel-memory-corruption primitive. The affected version range spans a decade of kernels (4.6–7.2.3). Ubuntu's Medium rating underweights the role multiplier for virtualized and containerized infrastructure.

1. Disable unprivileged user namespaces — Set kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0 via sysctl. This blocks the primary exploitation path without affecting root-level container runtimes (Docker/containerd run as root and create namespaces with CAP_SYS_ADMIN). Deploy within 30 days per the noisgate mitigation SLA for HIGH. Test on staging first — some workloads (Flatpak, Chrome sandbox, rootless Podman) depend on unprivileged namespaces.
2. Restrict /dev/net/tun access — Tighten device permissions or use a udev rule to limit /dev/net/tun to specific groups (e.g., kvm, libvirt). This reduces the attack surface for non-containerized hosts. Deploy within 30 days.
3. Deploy Falco or Tetragon runtime rules — Add detection rules for unexpected clone(CLONE_NEWUSER) syscalls, TUN device creation from non-standard processes, and uid-0 transitions without corresponding sudo/su. These provide detection-in-depth while patching progresses.
4. Prioritize kernel patching on container and VM hosts — Kubernetes nodes, KVM hypervisors, and CI runners should be first in the patching queue. These are where TUN is most active and the blast radius is highest. Target the noisgate remediation SLA of 180 days, but front-load high-value roles.

Run this script on each target Linux host as any user. It checks the running kernel version against known-fixed versions. Invoke with: bash check_cve_2026_81000.sh. No elevated privileges required.

#!/bin/bash
# CVE-2026-81000 (TUNderflow) — kernel version check
# Checks running kernel against fixed stable branches.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"

# Extract major.minor.patch from kernel version string
MAJOR=$(echo "$KERNEL" | cut -d. -f1)
MINOR=$(echo "$KERNEL" | cut -d. -f2)
PATCH=$(echo "$KERNEL" | cut -d. -f3 | cut -d- -f1)

# version_ge: returns 0 if $1.$2.$3 >= $4.$5.$6
version_ge() {
  local a1=$1 a2=$2 a3=$3 b1=$4 b2=$5 b3=$6
  if [ "$a1" -gt "$b1" ] 2>/dev/null; then return 0; fi
  if [ "$a1" -lt "$b1" ] 2>/dev/null; then return 1; fi
  if [ "$a2" -gt "$b2" ] 2>/dev/null; then return 0; fi
  if [ "$a2" -lt "$b2" ] 2>/dev/null; then return 1; fi
  if [ "$a3" -ge "$b3" ] 2>/dev/null; then return 0; fi
  return 1
}

if [ -z "$MAJOR" ] || [ -z "$MINOR" ] || [ -z "$PATCH" ]; then
  echo "UNKNOWN — could not parse kernel version: $KERNEL"
  exit 2
fi

# Fixed versions per stable branch:
# 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
# Vulnerable range: 4.6 through unfixed branches

# Check if kernel predates the vulnerable commit (< 4.6)
if version_ge "$MAJOR" "$MINOR" "$PATCH" 4 6 0; then
  : # potentially vulnerable, continue checks
else
  echo "PATCHED — kernel $KERNEL predates the vulnerable code (introduced in 4.6)"
  exit 0
fi

VULN=1
case "${MAJOR}.${MINOR}" in
  5.10) version_ge "$MAJOR" "$MINOR" "$PATCH" 5 10 270 && VULN=0 ;;
  5.15) version_ge "$MAJOR" "$MINOR" "$PATCH" 5 15 221 && VULN=0 ;;
  6.1)  version_ge "$MAJOR" "$MINOR" "$PATCH" 6 1 188  && VULN=0 ;;
  6.6)  version_ge "$MAJOR" "$MINOR" "$PATCH" 6 6 157  && VULN=0 ;;
  6.12) version_ge "$MAJOR" "$MINOR" "$PATCH" 6 12 109 && VULN=0 ;;
  6.18) version_ge "$MAJOR" "$MINOR" "$PATCH" 6 18 50  && VULN=0 ;;
  7.2)  version_ge "$MAJOR" "$MINOR" "$PATCH" 7 2 4    && VULN=0 ;;
  7.3|7.4|7.5|7.6|7.7|7.8|7.9)
        VULN=0 ;; # 7.3+ includes the fix
  *)
    if [ "$MAJOR" -ge 8 ] 2>/dev/null; then
      VULN=0
    fi
    ;;
esac

# Also check: is TUN module loaded or built-in?
TUN_STATUS="unknown"
if lsmod 2>/dev/null | grep -q '^tun '; then
  TUN_STATUS="loaded"
elif [ -f /lib/modules/$(uname -r)/kernel/drivers/net/tun.ko* ] 2>/dev/null; then
  TUN_STATUS="available (not loaded)"
elif grep -q 'CONFIG_TUN=y' /boot/config-$(uname -r) 2>/dev/null; then
  TUN_STATUS="built-in"
fi
echo "[*] TUN module status: $TUN_STATUS"

# Check unprivileged userns
USERNS="unknown"
if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
  USERNS=$(cat /proc/sys/kernel/unprivileged_userns_clone)
  [ "$USERNS" = "1" ] && USERNS="enabled (exploitable)" || USERNS="disabled (mitigated)"
elif [ -f /proc/sys/user/max_user_namespaces ]; then
  VAL=$(cat /proc/sys/user/max_user_namespaces)
  [ "$VAL" -gt 0 ] 2>/dev/null && USERNS="enabled (max=$VAL)" || USERNS="disabled (mitigated)"
else
  USERNS="likely enabled (no restriction sysctl found)"
fi
echo "[*] Unprivileged user namespaces: $USERNS"

if [ "$VULN" -eq 0 ]; then
  echo "PATCHED — kernel $KERNEL is at or above the fix for this branch."
  exit 0
else
  echo "VULNERABLE — kernel $KERNEL is below the fix for CVE-2026-81000."
  exit 1
fi

Sources

1. SecurityOnline — Linux Kernel LPE Quartet Disclosed
2. Ubuntu Security — CVE-2026-81000
3. GBHackers — Linux Kernel Hit by 4 LPE Flaws
4. Vulners — CVE-2026-81000
5. OpenCVE — CVE-2026-81000
6. OSV — CVE-2026-81000
7. Strix AI — CVE-2026-81000 Fix & Details
8. OffSeq Threat Radar — CVE-2026-81000