The Linux kernel vulnerability CVE-2026-81000 involves the TUN driver where tun_get_user() uses tun->align both as skb headroom and for determining how much packet data to keep linear. If tun->align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows, resulting in a negative value stored in good_linear. This value wraps when assigned to a size_t linear variable, allowing tun_alloc_skb() to place skb->data outside the allocated head buffer. The patch bounds the headroom to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset, leaving space for raw TUN and TAP headers. It also pulls protocol bytes before access to maintain safety for nonlinear skbs from other allocation paths.

This vulnerability could cause memory corruption by placing skb->data outside its allocated buffer, potentially leading to kernel memory safety issues. The exact impact is not detailed in the input data, and no known exploits in the wild are reported.

A fix has been applied to bound the headroom stored by TUN to safe limits and adjust header processing to prevent out-of-bounds skb data placement. Users should update to the patched Linux kernel version containing this fix. Patch status is not explicitly confirmed in the input data; check the vendor advisory for current remediation guidance.