CVE-2026-81000 (GCVE-0-2026-81000)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-19 08:46
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.
References
Impacted products
Vendor Product Version
Linux Linux Version: eaea34b23c46bf17b4a5638be69ab3561854f34b
Version: eaea34b23c46bf17b4a5638be69ab3561854f34b
Version: eaea34b23c46bf17b4a5638be69ab3561854f34b
Version: eaea34b23c46bf17b4a5638be69ab3561854f34b
Version: eaea34b23c46bf17b4a5638be69ab3561854f34b
Version: eaea34b23c46bf17b4a5638be69ab3561854f34b
Version: eaea34b23c46bf17b4a5638be69ab3561854f34b
Version: eaea34b23c46bf17b4a5638be69ab3561854f34b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:22:04.024628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:38.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad715e713610d2d5473c3a6498c825ccecf26491",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "708e87937de93f445225c134a2e20519f9b4ce60",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "010eee265d6bd8769b6a523d2a0693d9b3f5df43",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "379d85c7f25f3e05a428225e6b8a65613c6e9b9d",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "e098d9cc8859614a7f7baebc96e32a5a16b18ed2",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "0ada54ea63e48b9c1608e917ccb7dfadbe86db28",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            },
            {
              "lessThan": "447c9303942c439a117d9b76ce6d6e2116b38ee7",
              "status": "affected",
              "version": "eaea34b23c46bf17b4a5638be69ab3561854f34b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: bound receive headroom\n\ntun_get_user() uses tun-\u003ealign both as skb headroom and when choosing how\nmuch packet data to keep linear. OVS can propagate an oversized headroom\nrequest from another port to TUN or TAP.\n\nWhen align is larger than the usable space in a one-page skb head,\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\nin good_linear. That value later wraps when assigned to the size_t linear\nvariable, and tun_alloc_skb() can place skb-\u003edata outside the allocated\nhead.\n\nBound the headroom stored by TUN to the one-page skb-head budget and the\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\n\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\naccessing them, so these checks remain safe for nonlinear skbs supplied by\nother allocation paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - tun_get_user() runs on write/sendmsg to /dev/net/tun after ndo_set_rx_headroom stores an oversized tun-\u003ealign. That is a local tun/tap injection path, not parsing of frames received from a remote peer.\nAC:L - The attacker fully controls both sides: inflate rx headroom via netkit IFLA_NETKIT_HEADROOM or the OVS/veth/VXLAN and bridge/veth/GRETAP loops, then write a TUN frame. No race or uninfluenced victim state is required.\nPR:L - TUNSETIFF uses ns_capable(net-\u003euser_ns, CAP_NET_ADMIN) and OVS vport commands use GENL_UNS_ADMIN_PERM, so an unprivileged user with a user+net namespace can create the topology and trigger the write.\nUI:N - The attacker opens /dev/net/tun, configures local net devices, and writes the frame; no separate victim action is required.\nS:U - The out-of-bounds access occurs in the same kernel that handles the local TUN write and yields privilege escalation within that kernel, not a VM/IOMMU boundary crossing.\nC:H - SKB_MAX_HEAD underflow wraps the linear length so tun_alloc_skb()/skb_reserve() can place skb-\u003edata outside the allocated head, turning later header reads and packet processing into out-of-bounds kernel reads.\nI:H - After skb-\u003edata is moved outside the allocated head, skb_copy_datagram_from_iter copies attacker-controlled frame bytes relative to that pointer, an out-of-bounds write usable for kernel corruption and control-flow hijacking.\nA:H - The misplaced skb leads to a kernel oops, BUG() in eth_type_trans/__skb_pull on a nonlinear TAP skb, or panic when the out-of-bounds access is hit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:46:24.640Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491"
        },
        {
          "url": "https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76"
        },
        {
          "url": "https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43"
        },
        {
          "url": "https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28"
        },
        {
          "url": "https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7"
        }
      ],
      "title": "net: tun: bound receive headroom",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-81000",
    "datePublished": "2026-09-11T19:42:54.181Z",
    "dateReserved": "2026-08-26T14:34:25.812Z",
    "dateUpdated": "2026-10-19T08:46:24.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-81000\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:22:04.024628Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:22:04.837Z\"}}], \"cna\": {\"title\": \"net: tun: bound receive headroom\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - tun_get_user() runs on write/sendmsg to /dev/net/tun after ndo_set_rx_headroom stores an oversized tun-\u003ealign. That is a local tun/tap injection path, not parsing of frames received from a remote peer.\\nAC:L - The attacker fully controls both sides: inflate rx headroom via netkit IFLA_NETKIT_HEADROOM or the OVS/veth/VXLAN and bridge/veth/GRETAP loops, then write a TUN frame. No race or uninfluenced victim state is required.\\nPR:L - TUNSETIFF uses ns_capable(net-\u003euser_ns, CAP_NET_ADMIN) and OVS vport commands use GENL_UNS_ADMIN_PERM, so an unprivileged user with a user+net namespace can create the topology and trigger the write.\\nUI:N - The attacker opens /dev/net/tun, configures local net devices, and writes the frame; no separate victim action is required.\\nS:U - The out-of-bounds access occurs in the same kernel that handles the local TUN write and yields privilege escalation within that kernel, not a VM/IOMMU boundary crossing.\\nC:H - SKB_MAX_HEAD underflow wraps the linear length so tun_alloc_skb()/skb_reserve() can place skb-\u003edata outside the allocated head, turning later header reads and packet processing into out-of-bounds kernel reads.\\nI:H - After skb-\u003edata is moved outside the allocated head, skb_copy_datagram_from_iter copies attacker-controlled frame bytes relative to that pointer, an out-of-bounds write usable for kernel corruption and control-flow hijacking.\\nA:H - The misplaced skb leads to a kernel oops, BUG() in eth_type_trans/__skb_pull on a nonlinear TAP skb, or panic when the out-of-bounds access is hit.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"eaea34b23c46bf17b4a5638be69ab3561854f34b\", \"lessThan\": \"ad715e713610d2d5473c3a6498c825ccecf26491\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eaea34b23c46bf17b4a5638be69ab3561854f34b\", \"lessThan\": \"708e87937de93f445225c134a2e20519f9b4ce60\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eaea34b23c46bf17b4a5638be69ab3561854f34b\", \"lessThan\": \"18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eaea34b23c46bf17b4a5638be69ab3561854f34b\", \"lessThan\": \"010eee265d6bd8769b6a523d2a0693d9b3f5df43\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eaea34b23c46bf17b4a5638be69ab3561854f34b\", \"lessThan\": \"379d85c7f25f3e05a428225e6b8a65613c6e9b9d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eaea34b23c46bf17b4a5638be69ab3561854f34b\", \"lessThan\": \"e098d9cc8859614a7f7baebc96e32a5a16b18ed2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eaea34b23c46bf17b4a5638be69ab3561854f34b\", \"lessThan\": \"0ada54ea63e48b9c1608e917ccb7dfadbe86db28\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"eaea34b23c46bf17b4a5638be69ab3561854f34b\", \"lessThan\": \"447c9303942c439a117d9b76ce6d6e2116b38ee7\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/tun.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.221\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.188\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.157\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.109\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.50\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.*\"}, {\"status\": \"unaffected\", \"version\": \"7.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/tun.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ad715e713610d2d5473c3a6498c825ccecf26491\"}, {\"url\": \"https://git.kernel.org/stable/c/708e87937de93f445225c134a2e20519f9b4ce60\"}, {\"url\": \"https://git.kernel.org/stable/c/18ef24cdb2eba32e38f1d27f2d02b7b4212e8f76\"}, {\"url\": \"https://git.kernel.org/stable/c/010eee265d6bd8769b6a523d2a0693d9b3f5df43\"}, {\"url\": \"https://git.kernel.org/stable/c/379d85c7f25f3e05a428225e6b8a65613c6e9b9d\"}, {\"url\": \"https://git.kernel.org/stable/c/e098d9cc8859614a7f7baebc96e32a5a16b18ed2\"}, {\"url\": \"https://git.kernel.org/stable/c/0ada54ea63e48b9c1608e917ccb7dfadbe86db28\"}, {\"url\": \"https://git.kernel.org/stable/c/447c9303942c439a117d9b76ce6d6e2116b38ee7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tun: bound receive headroom\\n\\ntun_get_user() uses tun-\u003ealign both as skb headroom and when choosing how\\nmuch packet data to keep linear. OVS can propagate an oversized headroom\\nrequest from another port to TUN or TAP.\\n\\nWhen align is larger than the usable space in a one-page skb head,\\nSKB_MAX_HEAD(align) underflows and the result becomes negative when stored\\nin good_linear. That value later wraps when assigned to the size_t linear\\nvariable, and tun_alloc_skb() can place skb-\u003edata outside the allocated\\nhead.\\n\\nBound the headroom stored by TUN to the one-page skb-head budget and the\\nlargest non-sentinel 16-bit skb header offset. Leave one linear byte for\\nraw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.\\n\\nAlso pull the raw-TUN protocol byte and the TAP Ethernet header before\\naccessing them, so these checks remain safe for nonlinear skbs supplied by\\nother allocation paths.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.270\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.221\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.188\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.157\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.109\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.50\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.4\", \"versionStartIncluding\": \"4.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3\", \"versionStartIncluding\": \"4.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-19T08:46:24.640Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-81000\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T08:46:24.640Z\", \"dateReserved\": \"2026-08-26T14:34:25.812Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-09-11T19:42:54.181Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.