Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

Summary

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Timeline

1. Jul 24, 2023, 3:19 PM UTCCVE published
2. Mar 5, 2025, 6:36 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Feb 26, 2026, 8:27 PM UTCRecord last updated

Affected versions

• kernel-rt

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kernel-rt

  Version range not reported

References 25