CVE-2026-99281: Linux kernel · tun: Require CAP_NET_ADMIN to attach to an ownerless device
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in ffdf678dd16610e3f006dac904bd37c09684673c : patch Linux kernel soon.
Data as of 7 Nov 2026, 14:19 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in ffdf678dd16610e3f006dac904bd37c09684673c, e53d1cf05da8ea58a5743b7ce5894fb51b0b9700, 2f92c0286cfd58bff9d6d54c01a771073d5eb775
Exploitation evidence
Disclosed: evidence found.
CVE published 7 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 7 Nov 2026.
What to do
Upgrade Linux kernel to ffdf678dd16610e3f006dac904bd37c09684673c, e53d1cf05da8ea58a5743b7ce5894fb51b0b9700 or 2f92c0286cfd58bff9d6d54c01a771073d5eb775.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in specific Linux kernel commits and versions. Users and administrators should update to the fixed kernel versions to ensure that attaching to ownerless tun devices requires CAP_NET_ADMIN capability. No additional mitigation is required beyond applying the official fix.
Description
This vulnerability in the Linux kernel involves the tun (network TUN/TAP) device driver. It fixes a security issue where attaching to a persistent tun device without an assigned owner or group did not require the CAP_NET_ADMIN capability, allowing unauthorized access. The fix enforces that attaching to such ownerless devices now requires CAP_NET_ADMIN, closing this loophole while preserving existing ownership and permission models.