CVE-2026-52940: tun: zero the whole vnet header in tun_put_user()
In the Linux kernel, the following vulnerability has been resolved:
tun: zero the whole vnet header in tunputuser()
tunputuser() declares an on-stack struct virtionethdrv1hashtunnel without zeroing it. For a non-tunnel skb, virtionethdrtnlfromskb() only initializes the first 10 bytes (sizeof(struct virtionethdr)), leaving bytes 10..23 (numbuffers and the hash/tunnel fields) as stack garbage.
An unprivileged user can set the vnet header size to 24 with TUNSETVNETHDRSZ, so tunvnethdrput() copies all 24 bytes of the partially-initialized struct to userspace, leaking 14 bytes of kernel stack on every read of a non-tunnel packet.
Fix it the same way tungetuser() already does by zeroing the whole header right after declaration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux kernel tunto a version that resolves this vulnerability.Fixed in TUNSETVNETHDRSZ - Configuration
Apply the kernel fix so tun_put_user() zeroes the entire virtio_net_hdr_v1_hash_tunnel/virtio_net_hdr buffer before __tun_vnet_hdr_put() copies it, preventing garbage/stack bytes 10..23 from being leaked to userspace on reads of non-tunnel packets.
Linux kernel tun tun_put_user() vnet header initialization = zero the whole vnet header (set TUNSETVNETHDRSZ-related bytes to zero)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52940?
CVE-2026-52940 has a risk score of 45, indicating a medium severity vulnerability.
How do I fix CVE-2026-52940?
To fix CVE-2026-52940, update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-52940?
CVE-2026-52940 affects the Linux kernel versions that contain the vulnerable code in tun_put_user().
What type of vulnerability is CVE-2026-52940?
CVE-2026-52940 is a memory handling vulnerability in the Linux kernel related to uninitialized memory in network packet handling.
Is CVE-2026-52940 being actively exploited?
As of now, there are no public reports indicating active exploitation of CVE-2026-52940.